Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why not log into web sites via email without any password?

news.ycombinator.com

Post reply on HN
Print view View original

31–40 of 40 posts

Re: Ask HN: Why not log into web sites via email without any password?

#31

Post by nebula »

nzmsv wrote: post #13
jrockway wrote: post #10

Because you don't want your sysadmin logging into your favorite dating site as you? If you are going to do this right, you need email encryption. In which case, you have a client-side certificate. In which case, you might as well just authenticate over SSL with that certificate. But hey, why do something secure and built-in to every browser (even IE) when you can invent your own protocol instead? It's the Internet! A…

Well, the sysadmin could click on "restore password" on that super-secret site they want to steal your password to, and then check your mailbox. So this is really no different in terms of security. Also, I'm sure I have a dozen restore password emails in GMail somewhere. And I'm sure I'm not alone.

Generally, password reset links will have a timeout associated with them. Also, if someone does manage to use the password reset link in your mailbox and reset the password before it expires, you will come to know that your password is not working anymore, and you can act on it. It's not same as someone silently logging into your account through your email. This doesn't in anyway mean that it's safe to send password reset links to your mailbox if it's already compromised, though.

Re: Ask HN: Why not log into web sites via email without any password?

#32

Post by avinashv »

Actually, 1Password, a Mac-only app (I think) that I use reminded me of this.

For the unaware, the app basically plugs in to your browser and with a "master password" recalls all your logins. I basically go to a webpage, hit the 1p button and I'm golden. If it's the start of a session, I'm asked to enter my master password and that's about it.

Obviously the service doesn't have any control of this, and I am reliant on 1password's security and the security of my password, but it's convenient. I can't see email being the only login because I'd be worried of giving my email password to anybody.

Re: Ask HN: Why not log into web sites via email without any password?

#33

Post by AndrewDucker »

patio11 wrote: post #29
tptacek wrote: post #19

If you take this idea and strip out the silly email part, you have the core idea behind OpenID.

The difference between this idea and OpenID is that real people actually know their email address, but not "that thing with all the squigglies in it, you know, the email address for Google". I really, really wish the OpenID standard had used email addresses as the identifier.

The problem is then verifying that that email address _is_ you.

With a URL it's trivial. Take mine for instance - andrewducker.livejournal.com

1) Go to that URL. Look for something like this: http://www.livejournal.com/openid/server.bml />

2) Forward the user there, saying that you're expecting them to be "andrewducker.livejournal.com"

3a) If you're already logged in and have given permission to that server to authenticate you to the page you came from then you just bounce back to the "success" page.

3b) If not then you have to log in and then it bounces you back.

4) Success

How would you do this with an email address?

Re: Ask HN: Why not log into web sites via email without any password?

#34

Post by walesmd »

avinashv wrote: post #32

Actually, 1Password, a Mac-only app (I think) that I use reminded me of this. For the unaware, the app basically plugs in to your browser and with a "master password" recalls all your logins. I basically go to a webpage, hit the 1p button and I'm golden. If it's the start of a session, I'm asked to enter my master password and that's about it. Obviously the service doesn't have any control of this, and I am reliant o…

There's a similar plugin for Firefox that accepts a "master password" salts, randomizes, hashes, performs magic, and submits that as the actual password to your service.

The end result is all of your accounts have a different and secure password, whereas you (the end user) only work with the single password.

I've been thinking of giving this a shot but just keep putting it off for various reasons (the long time commitment of resetting all of my passwords to the newer/safer credentials, what if I am on a machine w/o Firefox or the plugin, etc).

Re: Ask HN: Why not log into web sites via email without any password?

#35

Post by patio11 »

AndrewDucker wrote: post #33
patio11 wrote: post #29

Earlier quoted context omitted.

The difference between this idea and OpenID is that real people actually know their email address, but not "that thing with all the squigglies in it, you know, the email address for Google". I really, really wish the OpenID standard had used email addresses as the identifier.

The problem is then verifying that that email address _is_ you. With a URL it's trivial. Take mine for instance - andrewducker.livejournal.com 1) Go to that URL. Look for something like this: http://www.livejournal.com/openid/server.bml /> 2) Forward the user there, saying that you're expecting them to be "andrewducker.livejournal.com" 3a) If you're already logged in and have given permission to that server to authen…

How would you do this with an email address?

My single change to the OpenID spec: perform discovery on a "well known url" on the same domain the email address comes from. After that, its the same as OpenID is now.

Re: Ask HN: Why not log into web sites via email without any password?

#36

Post by fara »

In some cases why do we use a password at all. There are many times that I register to a site to download something (a pdf in scribd, a sdk in nokia) or to see a post or a link, in any of this cases I dont care if anyone wants to log in with my username and what are the chances that someone will log in with my username just to change my age or my sex... oh no... I'd rather be exposed to that than remembering another password.

Re: Ask HN: Why not log into web sites via email without any password?

#37

Post by jimm »

patio11 wrote: post #35
AndrewDucker wrote: post #33

Earlier quoted context omitted.

The problem is then verifying that that email address _is_ you. With a URL it's trivial. Take mine for instance - andrewducker.livejournal.com 1) Go to that URL. Look for something like this: http://www.livejournal.com/openid/server.bml /> 2) Forward the user there, saying that you're expecting them to be "andrewducker.livejournal.com" 3a) If you're already logged in and have given permission to that server to authen…

How would you do this with an email address? My single change to the OpenID spec: perform discovery on a "well known url" on the same domain the email address comes from. After that, its the same as OpenID is now.

That won't work for ISPs, will it? My email address shares a domain with hundreds of other users, and I don't think my ISP will care or want to maintain a "well known url" listing those users that want to use OpenID.

Re: Ask HN: Why not log into web sites via email without any password?

#38

Post by awwx »

Google has an interesting hybrid approach: http://sites.google.com/site/oauthgoog/UXFedLogin

If the user is logging in with an email account on a domain whose email is handled by an openid provider, it will switch over to logging you in with openid.

Though I'm dubious though about their wording suggestion of "No, help me log in" for the situation where you don't need a password because you can use openid.

A combination of your idea and Google's idea: let users login with only an email address. If the email's domain supports openid, use that, otherwise send an email with a link to log the user in.

Re: Ask HN: Why not log into web sites via email without any password?

#39

Post by AndrewDucker »

patio11 wrote: post #35
AndrewDucker wrote: post #33

Earlier quoted context omitted.

The problem is then verifying that that email address _is_ you. With a URL it's trivial. Take mine for instance - andrewducker.livejournal.com 1) Go to that URL. Look for something like this: http://www.livejournal.com/openid/server.bml /> 2) Forward the user there, saying that you're expecting them to be "andrewducker.livejournal.com" 3a) If you're already logged in and have given permission to that server to authen…

How would you do this with an email address? My single change to the OpenID spec: perform discovery on a "well known url" on the same domain the email address comes from. After that, its the same as OpenID is now.

So, something like: http://brad.livejournal.com/2357444.html

Re: Ask HN: Why not log into web sites via email without any password?

#40

Post by richardw »

pyre wrote: post #27
richardw wrote: post #16

I suspect one strong reason against is because it would require you to be near your email client, or to use a webmail service for all online logins. Currently that requirement applies only when you register or forget your password. If your address is a company one, without web access, you won't be able to access any of your online resources. What about the browser automating the procedure to openid?

He's saying the browser would automate the process. Presumably it would speak POP/IMAP and poll your INBOX. Some immediate technical issues here: 1. If you're not using a service with super fast SMTP processing (i.e. Google) your email might not show up immediately. This would delay the login process while you're waiting for the email to arrive. 2. What happens when the email is dropped? (due to some stupid spam IP/D…

1) Sure, but the browser has to know your password for pop, etc, or you have to type it in, saving nothing. If it does know, then you're stuck at your own browser or you have to teach some new browser where your mail server is, and put in a password.

I was saying any automation benefit for email would also help openid (for example) because it's already browser-based. If you can automate POP, you can automate openid.

Post reply on HN