Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why aren't one-time sign in links more popular for authentication?

news.ycombinator.com

Post reply on HN
Print view View original

11–20 of 198 posts

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#11

Post by starbugs »

We have tried this for a while and the following reasons made us kill it:

1. Email delivery latency: depending on the service you use, the time it takes to deliver emails to the user can vary. Worst case I encountered was up to 20 minutes delay when there were issues with Mailgun.

2. Usability: you have to leave your current app and switch to your mail client. You may be on a device where you don't have a mail client installed at all, so you have to provide a password login option as well.

3. The sign in dialog gets more complicated and it's hard to explain to users how it works as it is not all that common. This also had effects on sign up/sign in dialog design which we found to have a negative impact on conversion rates.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#14

Post by innocenat »

starbugs wrote: post #11

We have tried this for a while and the following reasons made us kill it: 1. Email delivery latency: depending on the service you use, the time it takes to deliver emails to the user can vary. Worst case I encountered was up to 20 minutes delay when there were issues with Mailgun. 2. Usability: you have to leave your current app and switch to your mail client. You may be on a device where you don't have a mail client…

I resonate deeply with this comment.

As an extension to your second point, sometimes I want to login to a service on a shared/public computer out of necessity. I'd really not want to login into my email on said computer too.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#16

Post by camhart »

starbugs wrote: post #11

We have tried this for a while and the following reasons made us kill it: 1. Email delivery latency: depending on the service you use, the time it takes to deliver emails to the user can vary. Worst case I encountered was up to 20 minutes delay when there were issues with Mailgun. 2. Usability: you have to leave your current app and switch to your mail client. You may be on a device where you don't have a mail client…

4. Email delivery period. Using AWS Simple Email Service, you're actually sharing an email server IP address with other accounts. At times those accounts can get the IP address added to spam lists. All the sudden your emails stop getting received on some clients.*

* Solution to this is to pay $$ / month to get a dedicated IP address, then never let it get added to a spam list.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#18

Post by starbugs »

camhart wrote: post #16
starbugs wrote: post #11

We have tried this for a while and the following reasons made us kill it: 1. Email delivery latency: depending on the service you use, the time it takes to deliver emails to the user can vary. Worst case I encountered was up to 20 minutes delay when there were issues with Mailgun. 2. Usability: you have to leave your current app and switch to your mail client. You may be on a device where you don't have a mail client…

4. Email delivery period. Using AWS Simple Email Service, you're actually sharing an email server IP address with other accounts. At times those accounts can get the IP address added to spam lists. All the sudden your emails stop getting received on some clients.* * Solution to this is to pay $$ / month to get a dedicated IP address, then never let it get added to a spam list.

We ended up purchasing a dedicated IP from Mailgun. This solves the spam/latency problem mostly, but brings about new problems.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#19

Post by dewey »

asiando wrote: post #9

I recently used Vercel’s awesome magic link login. The feature was so awesome that I just needed to open the link in whatever browser. Unfortunately that also means that if I click the link by mistake the bad actor now has full access to my account. All just a misclick away.

> Unfortunately that also means that if I click the link by mistake the bad actor now has full access to my account. All just a misclick away

Doesn’t clicking the link set cookies in your browser that then authenticate your session? How would you clicking the link somewhere give access to an attacker?

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#20

Post by albertgoeswoof »

starbugs wrote: post #18
camhart wrote: post #16

Earlier quoted context omitted.

4. Email delivery period. Using AWS Simple Email Service, you're actually sharing an email server IP address with other accounts. At times those accounts can get the IP address added to spam lists. All the sudden your emails stop getting received on some clients.* * Solution to this is to pay $$ / month to get a dedicated IP address, then never let it get added to a spam list.

We ended up purchasing a dedicated IP from Mailgun. This solves the spam/latency problem mostly, but brings about new problems.

What other problems do you face with a dedicated IP?
Post reply on HN