Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The "email is authentication" pattern

rubenerd.com

Post reply on HN
Print view View original

451–460 of 474 posts

Re: The "email is authentication" pattern

#451

Post by dogcomplex »

dogcomplex wrote: post #21

At this point why not just pass a one-time url link to your email address, and have it be a single click to login? Have it expire within 10 mins if not used, and be one-time use disposable. Still, anyone who has the link initially should be able to login with your account - but it's only accessible from your email. Obliterates all sense of security beyond the email account itself, but that's where we're at anyway. Do…

Hah this blew up. tbf I meant instead of any Forgot Password or Send Authentication Code or whatever mess - if you can remember your password, do that to save more time.

Still, the loop to hit up email is so fundamental now the rest are secondary options - these Magic Links should just be the primary base-level expectation. It's annoying when services don't even get this right though and return you to the site with either:

- a new form to enter the one-time code they just sent (just put it in the link)

- a new form to enter a new password (who cares, make that optional to the actual sign in, to save time next login)

- (worst offense): they don't even actually sign you in after those forms and you have to re-enter everything

Login should be "do you have an email address? Okay great you're in". Because there is nothing beyond that from a security perspective these days.

Re: The "email is authentication" pattern

#452

Post by dogcomplex »

archerx wrote: post #223
dogcomplex wrote: post #21

At this point why not just pass a one-time url link to your email address, and have it be a single click to login? Have it expire within 10 mins if not used, and be one-time use disposable. Still, anyone who has the link initially should be able to login with your account - but it's only accessible from your email. Obliterates all sense of security beyond the email account itself, but that's where we're at anyway. Do…

I hate this with a passion and many sites use it like anthropic and clipdrop, I stopped buying credits on Clipdrop because logging in was so annoying. My email is on my phone and I want to access the site on my laptop. This adds so much friction and turns a 5 second task with one to two clicks into a longer than a minute task with many clicks. I emailed anthropic about this and they did added a login with google opti…

WELL FUCK YOU TOO! - jk, I agree. Password option should be there still for saving sessions and avoiding this crap beyond the first registration (if you remember password), but I just meant this should be the baseline expectation of login flow. Oneclick google/facebook/etc too, despite those being an extra level of corporate data hell

Re: The "email is authentication" pattern

#453

Post by dogcomplex »

klabb3 wrote: post #100
byteflip wrote: post #61

Earlier quoted context omitted.

I'm coding up a webapp with this exact login process - the issue I've found is on mobile phones - apps like gmail won't let you copy the link into a browser without a preview. The preview consumes the link. (next.js auth) It's a bit annoying, since I don't want to login into the gmail in-app browser, I want to login on my regular browser.

Yes easy mistake to make. But this goes back to HTTP basics: a GET request shouldn’t mutate state. Either don’t consume the link (ie allow reuse), have a user confirm action with POST, send a code instead. There are many alternatives. Personal favorite? Send a 6-digit code with ~1h expiry, exchange for a refresh token and keep the session for a long time. If you have really high value irreversible actions then you ca…

Send that code autofilled into the destination url form so it's a second POST click to login and sounds good.

Re: The "email is authentication" pattern

#454

Post by dogcomplex »

sensanaty wrote: post #282
dogcomplex wrote: post #21

At this point why not just pass a one-time url link to your email address, and have it be a single click to login? Have it expire within 10 mins if not used, and be one-time use disposable. Still, anyone who has the link initially should be able to login with your account - but it's only accessible from your email. Obliterates all sense of security beyond the email account itself, but that's where we're at anyway. Do…

I despise magic links. The rare few times I have to log back into Notion or Slack, I want to rip my hair out because of how annoying of a system it is. Please, for the love of god, just let me use my username/email and password. Have the magic link for the dummies that don't use a password manager if you have to, just let me do the username + password way.

I agree though the magic links should be the baseline default expectation of minimal registration/forgot-password effort

Re: The "email is authentication" pattern

#455

Post by dogcomplex »

j45 wrote: post #81
dogcomplex wrote: post #21

At this point why not just pass a one-time url link to your email address, and have it be a single click to login? Have it expire within 10 mins if not used, and be one-time use disposable. Still, anyone who has the link initially should be able to login with your account - but it's only accessible from your email. Obliterates all sense of security beyond the email account itself, but that's where we're at anyway. Do…

A pattern to make signups faster doesn't make them secure. Magic links can be more like convenience links, not secure, or security.

Agreed with OP, the security is basically nonexistent anyway due to Forgot Password flow making email the authority regardless. Sure, add a user/pass flow in addition for convenience and added security (i.e. delay the 3 minutes it takes to do a reset), but any real security would have to remove Forgot Password altogether or seriously delay turnaround time.

Re: The "email is authentication" pattern

#456

Post by gloosx »

lbriner wrote: post #305
gloosx wrote: post #236

>why they do this There is always a simple answer to such question, and it's usually about some inconvenience the service provider decided to set-up for the user. In this particular case I think the answer is obvious: email provider usually have a session which never really ends, and just sits there logged in unless the browser cache is wiped. Make your service auth token to live for the same time as Gmail's, and as…

I think this is closer to hinting at the truth. GMail and Cloudflare (and many other "high security orgs) have very long auth sessions. Why? Because the chance of somebody getting onto the PC of someone who uses these systems and hasn't logged out is actually really low. Most hacks are remote and based on weak passwords. Unfortunately, we lack the consistent language to measure risk and decide "do I really need 2FA o…

I also hate password expiration rules. A true manager's "bright idea" which is horrible for security. Once I was registered on a service which required a password change every month, so every single month I had to change a letter or number in my password, because they also stored all my previous passwords and did not let me just swap 2 passwords around, forcing me to create a "new" one every time. BTW my password is 24 characters of solid gibberrish which I can only remember by chanting a long mnemotechnique in my head, obviously never leaking anywhere and unpickable. So changing it is not easy. At some point I was so mad when I could not change a password in a way it did not repeat any of my previous modifications and still remembered easily, so i just put qwerty123 in, needing to log-in into service desperately. It was bruteforced days after.

Re: The "email is authentication" pattern

#457

Post by EVa5I7bHFq9mnYK »

tptacek wrote: post #3

Email accounts are the highest common denominator in online authentication. Phones are competitive, but people lose phones. Phone numbers are more common and durable, but the security of phone numbers is leagues below that of a flagship provider email account. It makes sense that so many authentication flows work this way. When designing a "fantasy football" alternate authentication system for the Internet, start wit…

Everything is vulnerable. Lost my email when email provider (openmailbox.org) closed, with no chance of recovery. And with it lost a 28-years old domain.

People have lost Gmail accounts over some YouTube comment.

Lost my phone couple of times and was able to restore authy from backup ok.

Re: The "email is authentication" pattern

#458

Post by EVa5I7bHFq9mnYK »

Vegenoid wrote: post #427
drdaeman wrote: post #426

Earlier quoted context omitted.

> Most people do not want to do this Yes, and I think that's not because they don't want to do it but because: 1) they don't know that they should do this; 2) they don't know why should they do this; 2) they don't know how to do this; 3) because even the systems marketed as current state-of-art (Passkeys) are poorly designed and don't even allow to have proper 3-2-1 backups conveniently (can't enroll a device sitting…

> We manage to explain people to not poke with scissors into electrical outlets (and make it hard to do so accidentally) - we can manage similar stuff with computers too. I don't think this is a good analogy, because the example is simply warning people of a thing not to do. It takes no effort. Maintaining backups does take effort. This is more like getting people to pick up a new chore, just like how many people see…

People's bank accounts are irreversibly hacked, emptied, frozen, seized, blocked, impounded, garnished on a daily basis. That you haven't encountered it yet, doesn't mean it's not happening.

People should have a choice which system suits them more.

Re: The "email is authentication" pattern

#459

Post by Xen9 »

Vegenoid wrote: post #427
drdaeman wrote: post #426

Earlier quoted context omitted.

> Most people do not want to do this Yes, and I think that's not because they don't want to do it but because: 1) they don't know that they should do this; 2) they don't know why should they do this; 2) they don't know how to do this; 3) because even the systems marketed as current state-of-art (Passkeys) are poorly designed and don't even allow to have proper 3-2-1 backups conveniently (can't enroll a device sitting…

> We manage to explain people to not poke with scissors into electrical outlets (and make it hard to do so accidentally) - we can manage similar stuff with computers too. I don't think this is a good analogy, because the example is simply warning people of a thing not to do. It takes no effort. Maintaining backups does take effort. This is more like getting people to pick up a new chore, just like how many people see…

Highly relevant (self-advertisement):

https://news.ycombinator.com/item?id=41173227

Post reply on HN