Live data from Hacker News

The "email is authentication" pattern

rubenerd.com

471–474 of 474 posts

Re: The "email is authentication" pattern

#471

Earlier quoted context omitted.

> I believe nearly every single article about setting up a self-managed crypto wallet had stressed out the importance of having a backup. Serious ones had even explained the 3-2-1 rule. Yes, this is why it is incompatible with widespread adoption. Most people do not want to do this, and in fact could not do so effectively without learning and thinking a good deal more about computers and risk scenarios, which they do…

> Most people do not want to do this Yes, and I think that's not because they don't want to do it but because: 1) they don't know that they should do this; 2) they don't know why should they do this; 2) they don't know how to do this; 3) because even the systems marketed as current state-of-art (Passkeys) are poorly designed and don't even allow to have proper 3-2-1 backups conveniently (can't enroll a device sitting…

Not reusing passwords at all is pretty impractical. If you really want to depend on a single password manager then you have some other issues. Usually I have settled for rotating, compartmentalized password modules which allows me to somewhat rather than fully contain a compromised password. And if your modular password has three slots (term taken from linguistics) then you can compose passwords which reuse parts, are memorizable, and not automatically reusable on other services.

The problem though is that since one has a number of passwords which may be different but closely related, a human may be able to infer a few possible passwords from a few compromised ones. In other words it still dramatically shrinks the key space an attacker might want to try to brute force. Preventing re-use is then a problem for 2fa regimes.

For my part I won't use passwords I cannot memorize and keep memorized in relation to the web site.

Re: The "email is authentication" pattern

#472

A physical key you have put in your computer and store on your keychain.

And if you lose / damage that physical key? Look at the physical world analogue. If you lose a house key, you can force the lock, break down the door, re-key the door, pick the lock, or any number of other means of re-gaining access, up to and including going through the wall / ceiling / floor. If you lose an authentication key, you're S.O.L.

That is true, there is no silver bullet. For the people like me that know and have multiple keys in multiple secure locations are probably mostly fine, other solutions on government och bank websites is that they need somekind of formal verification before giving you a new key. There are always tradeoffs regardless of solution, depends on what you value.

Re: The "email is authentication" pattern

#473
post #236

>why they do this There is always a simple answer to such question, and it's usually about some inconvenience the service provider decided to set-up for the user. In this particular case I think the answer is obvious: email provider usually have a session which never really ends, and just sits there logged in unless the browser cache is wiped. Make your service auth token to live for the same time as Gmail's, and as…

The real reason may be that the websites in question simply do not work.

I have had troubles with Epic and Spotify accounts in the past. I make an account, I use it for a week, after a week session expires - Spotify kicks me out of my account. I try to log in, it says my password is incorrect. This is impossible, because my password is saved in my password manager. So I have no choice but to reset through email. First several times I receive the email, reset the password, the pattern repeats, after 3 or 4 repeats I don't even receive the email anymore, so I am forced to make a new account.

Currently I am logged into Spotify through my Google account, where I have zero issues so far. But if I use plain email, their auth system simply does not work.

Re: The "email is authentication" pattern

#474

Earlier quoted context omitted.

My wife works in a city clerk's office. They provide (among other things) vital records services for the city. Like getting birth certificates. To get a birth certificate, you must provide government photo ID with a name matching that of one of the names on the certificate you're trying to get . So you can get your own, or your child's, but not some random other person's. Lots of people were born before RealID driver…

How did he get a driver's licence with the name "Sam"? Don't you need some form of judicial process to change your name on this kind of thing?

Used his Army ID. World War 2 recruitment wasn't big on background checks.
Post reply on HN