Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The "email is authentication" pattern

rubenerd.com

Post reply on HN
Print view View original

401–410 of 474 posts

Re: The "email is authentication" pattern

#401

Post by lxgr »

Too wrote: post #246
dogcomplex wrote: post #21

At this point why not just pass a one-time url link to your email address, and have it be a single click to login? Have it expire within 10 mins if not used, and be one-time use disposable. Still, anyone who has the link initially should be able to login with your account - but it's only accessible from your email. Obliterates all sense of security beyond the email account itself, but that's where we're at anyway. Do…

At that point you might as well go all in on single sign on. 95% of all users are going to be on gmail, outlook or apple anyway. Better to have a "sign in with google" button rather than "send a link to your (g)mail". They can track you either way.

Please have both. We don't need more forced centralization when it comes to authentication.

Re: The "email is authentication" pattern

#402

Post by lxgr »

MBCook wrote: post #15
paulgerhardt wrote: post #8

I’ll be hyperbolic and say the login flow is identical. A) Go to website, click through a password manager to copy and paste an arbitrary string of characters, receive TOTP request sent to your email to confirm your identity. Or B) Go to website, click forgot my password. Receive link to login. Enter an arbitrary string of characters. In many instances, login flow B is actually quicker and seldom slower. Clicking the…

Who copy and pastes from a password manager? Here’s my workflow, and I consider it superior to both of the above. Go to site, Safari offers to autofill, give TouchID/FaceID, get asked for a 2 factor code. Sent via SMS/email? Safari offers to autofill for me. TOTP style? Safari offers to autofill for me. Easy peasy. Passkeys are even easier as there is no second step and waiting for SMS/email.

Me, every time another site annoyingly breaks autofill, sometimes even intentionally ("Password managers not allowed! Make sure to memorize your password, but still use at least 5 special characters and include at least 3 titles of ABBA songs!!").

Re: The "email is authentication" pattern

#403

Post by lxgr »

protocolture wrote: post #286

A few services are just bypassing passwords and emailing you one time codes these days and it isnt the worst idea for exactly this reason.

I agree, but I strongly prefer the ones that allow both. I use a password manager, and a mandatory OTP email flow often annoys me enough that I think twice about logging in if it's not that urgent.

Re: The "email is authentication" pattern

#404

Post by [deleted] »

thaumasiotes wrote: post #216
simonw wrote: post #120

Earlier quoted context omitted.

> If the answer is "they just don't get access anymore" or "a panel of their peers attests to them", your fantasy authentication system also needs a fantasy species of sentient beings to serve as users, because it won't work for humans. This has been my single biggest argument against blockchain/cryptocurrency stuff for years: the "lose your key, lose your wallet" thing is fundamentally incompatible with real users.…

> This has been my single biggest argument against blockchain/cryptocurrency stuff for years: the "lose your key, lose your wallet" thing is fundamentally incompatible with real users. This would make currency fundamentally incompatible with real users. Reality says otherwise.

[deleted]

Re: The "email is authentication" pattern

#405

Post by ftlio »

lwansbrough wrote: post #339

We run a pretty unserious business. That is, our users use our accounts only out of convenience. The system we've settled on is this: 1. User enters email 2. We send a verification code to their email 3. User enters code, is signed in "indefinitely" (very, very long cookie) Whether or not they had an account before hand is irrelevant, we just register a new account if the email is new. The occasional user has multipl…

This is how I’ve implemented login several times now, and it comes from repeatedly having to undo a ton of assumptions about what a User Account is when attempting to modify a funnel to just actually work how people want it to on both sides of the equation.

Unless you’re operating in an anonymity preserving space, you can just do this and choose to integrate with passkey later.

The main disadvantage of this method is that you have to think about managing multiple users for an account sooner than you normally would, since sharing a password is no longer possible. I can’t think of a funnel or UX that isn’t ultimately improved by conscious effort here.

The other is of course that your security becomes limited by the weighted average of security of your users’ email providers, which will generally be better than you need. Passwords can then be your second factor here, when you finally need them, or you can use some other factor yet again. In B2B you can jump straight to SAML or OIDC connections.

In B2B or D2C contexts this has always just worked and the edge cases are generally worth solving for the benefits to acquisition.

Re: The "email is authentication" pattern

#406

Post by EnigmaFlare »

SPBS wrote: post #272

Wow, that's awful. So they abuse "forgot your password" as a login method, with the added obstacle of having to come up with a random password every time. And they don't see any problem with it. My hunch is that all these people are very non-technical users.

I do that for some sites. It's the initial effort required to set everything up that's the obstacle. This kind of behavior is taking the easiest route at every step instead of investing time into making the future easier. I stopped using a password manager after it got hacked and haven't bothered setting up a new one.

The most annoying sites require you to confirm your throwaway password or log in again using it, and can't copy from the password field, so you can't just spam the keyboard and have to type it into notepad then copy and paste a few times before discarding it. This is stupidly inconvenient to do all the time but the alternative is more inconvenient to do once - researching which password manager is currently safe, finding it, installing it, writing down your master password somewhere really safe, etc. Then keeping on top of the news for the rest of your life to see if your password manager is going down the gurgler or been hacked. Also, will my passwords be available when I travel to a country with restricted internet? Who knows. Can I export my passwords to any other password manager or a text file if I need migrate? That's part of the research needed to even get started using a password manager.

Re: The "email is authentication" pattern

#407

Post by suprjami »

archerx wrote: post #334
system33- wrote: post #332

Earlier quoted context omitted.

I think their point is that no matter how secure your base password is, once one site leaks it, the bad guy basically knows your password to every site.

I have been using the internet since the 90s, my Hotmail account is 23 years old and I have never lost any of my accounts. I think it’s working quite well in my experience.

It will, right up until the day it doesn't.

You just need one little website to leak passwords in plaintext and all your passwords are up for grabs.

I used to do the same thing and I stopped for that reason.

Re: The "email is authentication" pattern

#408

Post by dagw »

bburnett44 wrote: post #336
throwaway290 wrote: post #317

Earlier quoted context omitted.

A fire, a flood, a robbery...

Is a bank deposit box not insured against those things? I've never really thought about it but always assumed they would be

Probably varies from bank to bank, but in my experience you have to specifically buy separate insurance if you want the content of your deposit box insured. The big problem from the bank's point of view is that, unlike your bank account, the bank doesn't know what you have in the box and thus has no idea what to insure it for and no way to verify any claim.

Re: The "email is authentication" pattern

#409

Post by XajniN »

fragmede wrote: post #240
jjmarr wrote: post #238

Earlier quoted context omitted.

It's a lot harder for the average person to lose 1 million dollars in cash than in Bitcoin because humans naturally understand the exchange of physical objects. If I have a duffel bag of money, it is obvious that physical possession of the bills means I can access its value. Anything negating that possession would cost me my money. I should probably keep it away from open flames and water; but it's not going to spont…

The concept that this file is the password to the money isn't too complicated. The money isn't in two places at once, the file's the password to it.

It’s impossible to comprehend to most people.

Re: The "email is authentication" pattern

#410

Post by karmajunkie »

drdaeman wrote: post #389
simonw wrote: post #120

Earlier quoted context omitted.

> If the answer is "they just don't get access anymore" or "a panel of their peers attests to them", your fantasy authentication system also needs a fantasy species of sentient beings to serve as users, because it won't work for humans. This has been my single biggest argument against blockchain/cryptocurrency stuff for years: the "lose your key, lose your wallet" thing is fundamentally incompatible with real users.…

> [...] the "lose your key, lose your wallet" thing is fundamentally incompatible with real users. Humans need to be able to recover from their mistakes. Maybe it's my memory playing tricks, or I've only seen the good articles, but I believe nearly every single article about setting up a self-managed crypto wallet had stressed out the importance of having a backup. Serious ones had even explained the 3-2-1 rule. Then…

i think you’re sidestepping the parent’s point: if it depends on users doing the right thing every time, it’s not compatible with the real world.

yes, the advice about wallets is “make a backup”. the advice about passwords is “don’t reuse them”, yet the VAST majority of users use the same password for banking, email, and their phone provider. so what do you think the chances are that your average user makes a backup of their wallet AND remember where it is in three years?

pretty much zero.

Post reply on HN