Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why not log into web sites via email without any password?

news.ycombinator.com

Post reply on HN
Print view View original

21–30 of 40 posts

Re: Ask HN: Why not log into web sites via email without any password?

#21

Post by jasonlbaptiste »

we sort of did this with Ramamia. ACtually in the first version, there were NO passwords. You would create a family, then register your email to it. From that point on, the cookie kept you logged in or you clicked the email login link. People liked it, but enough also wanted passwords that we added them soon thereafter. The real takeaways were:

* Give before getting - we let you use the service before we ask for your email. * Make logging in via email simple. ie- Someone in your family posts a photo, you click on the link and you're logged in. * Don't get rid of norms (having passwords), but its okay to have new ways to get around it.

Re: Ask HN: Why not log into web sites via email without any password?

#22

Post by mdemare »

Realistically, browsers aren't going to implement this, whether it's a good idea or not.

But I could see this working for websites in the lowest tier of security (like HN). Set a cookie for a year, and if you lose it or move to a different computer, receive a secret link via mail.

Re: Ask HN: Why not log into web sites via email without any password?

#23

Post by dpcan »

I like the direction you are going.

Access to your website stays in my control. I'm not depending on a 3rd party service, OpenID, or anything else, it's my own personal email account, and that email account's ability to receive email is all that's required for it to work.

1) I enter my email address on your site.

2) My browser plugin sees that I've done this.

3) It checks my email for the link from your site, returns to your site, logs me in with that secure link, and I never had to enter a password.

This feels very similar to OpenID, only I don't need to rely on a service that's a part of the OpenID movement, and my password stays with me, my domain, and my email account wherever I choose to host it.

Re: Ask HN: Why not log into web sites via email without any password?

#24

Post by pyre »

dpcan wrote: post #23

I like the direction you are going. Access to your website stays in my control. I'm not depending on a 3rd party service, OpenID, or anything else, it's my own personal email account, and that email account's ability to receive email is all that's required for it to work. 1) I enter my email address on your site. 2) My browser plugin sees that I've done this. 3) It checks my email for the link from your site, returns…

Ok, but now your email password is the password to all your accounts. I know that in reality it already is since your email is used to reset the password for most accounts, but consider this: to fully automate the process, you'll have to give your browser (or plugin) your email password to store so that it can log you into the site without entering any password.

On a lighter note, even if someone has to enter their email password each time, it won't be such a pain to most people since they already use the same password everywhere. And hopefully this will be slightly more secure than having hundreds copies of the same password scattered about the 'net on servers with varying levels/quality of security.

Re: Ask HN: Why not log into web sites via email without any password?

#25

Post by pyre »

nzmsv wrote: post #13
jrockway wrote: post #10

Because you don't want your sysadmin logging into your favorite dating site as you? If you are going to do this right, you need email encryption. In which case, you have a client-side certificate. In which case, you might as well just authenticate over SSL with that certificate. But hey, why do something secure and built-in to every browser (even IE) when you can invent your own protocol instead? It's the Internet! A…

Well, the sysadmin could click on "restore password" on that super-secret site they want to steal your password to, and then check your mailbox. So this is really no different in terms of security. Also, I'm sure I have a dozen restore password emails in GMail somewhere. And I'm sure I'm not alone.

> I'm sure I have a dozen restore password emails in GMail somewhere

Maybe that should be the next Google Labs feature. The 'Mission Impossible' option. (i.e. 'this message will self-destruct')

Re: Ask HN: Why not log into web sites via email without any password?

#26

Post by pyre »

amichail wrote: post #12
jrockway wrote: post #10

Because you don't want your sysadmin logging into your favorite dating site as you? If you are going to do this right, you need email encryption. In which case, you have a client-side certificate. In which case, you might as well just authenticate over SSL with that certificate. But hey, why do something secure and built-in to every browser (even IE) when you can invent your own protocol instead? It's the Internet! A…

How come people are not upset that the "forgot password" protocol is not secure?

It's worth noting that this is how 4chan users 'hacked' those Christian Facebook pages.

Database of Christian dating site logins -> Same password as email -> Same password as Facebook and/or use email to reset

Re: Ask HN: Why not log into web sites via email without any password?

#27

Post by pyre »

richardw wrote: post #16

I suspect one strong reason against is because it would require you to be near your email client, or to use a webmail service for all online logins. Currently that requirement applies only when you register or forget your password. If your address is a company one, without web access, you won't be able to access any of your online resources. What about the browser automating the procedure to openid?

He's saying the browser would automate the process. Presumably it would speak POP/IMAP and poll your INBOX. Some immediate technical issues here:

1. If you're not using a service with super fast SMTP processing (i.e. Google) your email might not show up immediately. This would delay the login process while you're waiting for the email to arrive.

2. What happens when the email is dropped? (due to some stupid spam IP/Domain blacklist at the server-level)

3. What happens when the email ends up in your spam folder?

4. In relation to point #1, what happens when your email provider has an outage? You can't log into any other websites? This seems counter to the idea that the internet routes around problems. Your email account becomes a single point of failure. [I know that it's already a single point of failure from a security standpoint with password reset emails, but if my email server goes down, I can still login to sites as long as I remember my password]

Re: Ask HN: Why not log into web sites via email without any password?

#28

Post by pyre »

jrockway wrote: post #10

Because you don't want your sysadmin logging into your favorite dating site as you? If you are going to do this right, you need email encryption. In which case, you have a client-side certificate. In which case, you might as well just authenticate over SSL with that certificate. But hey, why do something secure and built-in to every browser (even IE) when you can invent your own protocol instead? It's the Internet! A…

> If you are going to do this right, you need email encryption. In which case, you have a client-side certificate. In which case, you might as well just authenticate over SSL with that certificate.

Maybe I'm reading this wrong, but isn't most email encryption done with GPG/PGP or S/MIME? Where do client-side SSL certificates come in?

Re: Ask HN: Why not log into web sites via email without any password?

#29

Post by patio11 »

tptacek wrote: post #19

If you take this idea and strip out the silly email part, you have the core idea behind OpenID.

The difference between this idea and OpenID is that real people actually know their email address, but not "that thing with all the squigglies in it, you know, the email address for Google".

I really, really wish the OpenID standard had used email addresses as the identifier.

Post reply on HN