Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The "email is authentication" pattern

rubenerd.com

Post reply on HN
Print view View original

361–370 of 474 posts

Re: The "email is authentication" pattern

#361

Post by mplewis »

adastra22 wrote: post #311
dogcomplex wrote: post #21

At this point why not just pass a one-time url link to your email address, and have it be a single click to login? Have it expire within 10 mins if not used, and be one-time use disposable. Still, anyone who has the link initially should be able to login with your account - but it's only accessible from your email. Obliterates all sense of security beyond the email account itself, but that's where we're at anyway. Do…

I don’t have access to my email on the computer in which I am trying to login to your web service.

Why not?

Re: The "email is authentication" pattern

#362

Post by mvitorino »

comprev wrote: post #348
simonw wrote: post #120

Earlier quoted context omitted.

> If the answer is "they just don't get access anymore" or "a panel of their peers attests to them", your fantasy authentication system also needs a fantasy species of sentient beings to serve as users, because it won't work for humans. This has been my single biggest argument against blockchain/cryptocurrency stuff for years: the "lose your key, lose your wallet" thing is fundamentally incompatible with real users.…

If you accidentally burn cash you cannot recover it. The paper in your hand isn't replicated in another place. Humans have been unable to recover from mistakes since day zero

Accidentally burning money is a very low probably event. Forgetting passwords or any type of memorized secret is the most likely default outcome, and chance only increases with time passing.

Re: The "email is authentication" pattern

#363

Post by FireBeyond »

alberth wrote: post #195
FireBeyond wrote: post #149

Earlier quoted context omitted.

The irony with that is that if someone undocumented wanted to leave the country, this requirement could potentially hinder that. I also don't really want to have to carry my green card around everywhere. Just one more thing that can be lost.

How would it? To travel internationally, a passport is required (not drivers licenses).

I might have been being more simplistic than I needed to be, because there are other travel methods, but I was more meaning, "Not everyone lives next door to an international hub" (so might need a connecting domestic flight).

Re: The "email is authentication" pattern

#364

Post by generic92034 »

soerxpso wrote: post #259
simonw wrote: post #120

Earlier quoted context omitted.

> If the answer is "they just don't get access anymore" or "a panel of their peers attests to them", your fantasy authentication system also needs a fantasy species of sentient beings to serve as users, because it won't work for humans. This has been my single biggest argument against blockchain/cryptocurrency stuff for years: the "lose your key, lose your wallet" thing is fundamentally incompatible with real users.…

> the "lose your key, lose your wallet" thing is fundamentally incompatible with real users. You're allowed to store your key at the bank if this is an issue for you. It's less secure than memorizing it, but obviously equally as secure as your bank account is.

I might be mistaken, but are not several "traditional" banks offering crypto wallets for customers? Is there a realistic chance this kind of bank is going to steal their customers' crypto and going (at least, next to criminal investigations) bankrupt over it?

Re: The "email is authentication" pattern

#365

Post by internet101010 »

Sometimes email is the best way. Like if you are constantly posting files to third-party file hosting services (Box, Dropbox, etc.) that are not tied to AD of the recipient you have to have a way to ensure that only people currently working at the company can access the content. SMS and TOTP do not solve this problem in the same way that email does.

Re: The "email is authentication" pattern

#366

Post by tasuki »

firesteelrain wrote: post #303
tasuki wrote: post #244

Earlier quoted context omitted.

How many own a lot of books? Just... pick one.

Not following? Do you know what I meant by a Class 5 safe? https://www.norfolksafe.com/

I don't. And frankly I don't think a safe is a good place to store secrets. It is too conspicuous.

Re: The "email is authentication" pattern

#367

Post by brainzap »

lwansbrough wrote: post #339

We run a pretty unserious business. That is, our users use our accounts only out of convenience. The system we've settled on is this: 1. User enters email 2. We send a verification code to their email 3. User enters code, is signed in "indefinitely" (very, very long cookie) Whether or not they had an account before hand is irrelevant, we just register a new account if the email is new. The occasional user has multipl…

How do you do very long cookie? I thought safari deletes them anyway after a certain time.

Re: The "email is authentication" pattern

#368

Post by Djdjur7373bb »

generic92034 wrote: post #364
soerxpso wrote: post #259

Earlier quoted context omitted.

> the "lose your key, lose your wallet" thing is fundamentally incompatible with real users. You're allowed to store your key at the bank if this is an issue for you. It's less secure than memorizing it, but obviously equally as secure as your bank account is.

I might be mistaken, but are not several "traditional" banks offering crypto wallets for customers? Is there a realistic chance this kind of bank is going to steal their customers' crypto and going (at least, next to criminal investigations) bankrupt over it?

Sure, they could. Would that be any different from how a bank could steal funds from a traditional deposit account?

By making a bank the custodian of your crypto wallet, you're placing your trust in them and should have similar legal recourse you would have had with a fiat deposit.

Re: The "email is authentication" pattern

#369

Post by Djdjur7373bb »

throwaway290 wrote: post #318
cooljoseph wrote: post #301

Earlier quoted context omitted.

I don't understand why this was downvoted. In case it's not clear: (S)he's saying to split the key into multiple shares that can be used to reconstruct the key if you have a large enough quorum. Then store each share in a different place. As long as you don't lose too many of the shares, you'll be fine. And one baddie is NOT enough to get the key.

Either shuffling those keys stored in N different deposit boxes is overly complicated for a normal person, or it is not overly complicated for a moderately dedicated baddie either

Unless the "baddie" in this case is the government, why would it be easy for anyone to obtain access to multiple secrets stored in multiple boxes/banks?

Multisig is a pretty common setup for crypto and there is software that makes it easier.

Re: The "email is authentication" pattern

#370

Post by firesteelrain »

tasuki wrote: post #366
firesteelrain wrote: post #303

Earlier quoted context omitted.

Not following? Do you know what I meant by a Class 5 safe? https://www.norfolksafe.com/

I don't. And frankly I don't think a safe is a good place to store secrets. It is too conspicuous.

These safes are certified for all kinds of sensitive (GSA recommends them for Classified use from what I have read) use and they are safe.

Ideally, you connect Vault to a HSM if you need that kind of security that’s being described. HSMs are electronic safes

Post reply on HN