Ask HN: Why aren't one-time sign in links more popular for authentication? • Hacker News Board

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#161

Post by fredcy » Mon, Jan 04, 2021, 4:43 PM UTC

swiley wrote: post #102

starbugs wrote: post #11

We have tried this for a while and the following reasons made us kill it: 1. Email delivery latency: depending on the service you use, the time it takes to deliver emails to the user can vary. Worst case I encountered was up to 20 minutes delay when there were issues with Mailgun. 2. Usability: you have to leave your current app and switch to your mail client. You may be on a device where you don't have a mail client…

One more issue is if you're using eg microsofts webmail (office? hotmail? I'm not sure what it's called but my university had it) the links will get queried automatically to "scan them for viruses" which tends to expire them.

We ran into this, where the Outlook client would scan one-time login links from SalesForce (iirc). Huge pain to work around.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#162

Post by CodesInChaos » Mon, Jan 04, 2021, 4:47 PM UTC

bronson wrote: post #61

Some people use mail clients that either preview or spam-check links. Every OTP you send them shows up as "already used." Then they blame you and not their mail client. Related, I've consulted for a company that downloads and caches every link in every email passing through their corporate server.

Since HTTP GET requests are specified as not having any significant side-effects, I'd blame your app as well.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#163

Post by kevincox » Mon, Jan 04, 2021, 5:23 PM UTC

elwell wrote: post #136

_carl_jung wrote: post #29

Earlier quoted context omitted.

Password management is better, not worse, for security.

What is your argument for that? That people will choose better passwords (unique and long) since they don't need to remember them? The Achille's heel of password managers is if someone accesses your computer (physically or remotely) they can probably access all your accounts. <-- and I've seen this happen (not to me)

If they can access you computer they can probably also access your email and get the sign-in links.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#164

Post by kevincox » Mon, Jan 04, 2021, 5:30 PM UTC

ytch wrote: post #93

How about scan QR code on login screen by authenticated APP on phone. Many companies in China use this way. does there have any possible exploit/disadvantage of this method?

1. I don't want to install you app. 2. I don't want to find and pick up my phone. 3. How do you log in to the app? This has a bootstrapping problem.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#165

Post by sgoto » Mon, Jan 04, 2021, 5:52 PM UTC

https://twitter.com/samuelgoto/status/1346145032663756805

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#166

Post by CuriousCosmic » Mon, Jan 04, 2021, 6:41 PM UTC

gog wrote: post #159

CuriousCosmic wrote: post #131

Earlier quoted context omitted.

You'd have to look at your logs when it happens but google has a habit of tarpitting(i.e. repeatedly delaying email receipt) emails from servers they don't necessarily "trust". For large providers (i.e. those that would be used for handling one-time link emails), this normally isn't a problem however for small or self hosted email servers it can be from time to time. I'm not sure what all goes into ~~the algorithm~~…

Thank you. I've checked my logs and everything looks normal on my end and I do suppose it is some kind of tarpitting, but it doesn't show in the logs. I do have DKIM, strict SPF and DMARC policies, MTA-STS, SMTP TLS Reporting, latest TLS support and valid certificates, there is nothing else I can do on my end.

One other thing you might be able to try is to try reaching out to Google about it if it's a consistent issue. There is a contact form floating around somewhere for mail server operators to reach out to the GMail infra team about this kind of thing but IDK where it is or if they even still check it. I wouldn't put to much faith in it though, particularly considering Google's reputation wrt support.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#167

Post by jjeaff » Mon, Jan 04, 2021, 6:48 PM UTC

starbugs wrote: post #11

We have tried this for a while and the following reasons made us kill it: 1. Email delivery latency: depending on the service you use, the time it takes to deliver emails to the user can vary. Worst case I encountered was up to 20 minutes delay when there were issues with Mailgun. 2. Usability: you have to leave your current app and switch to your mail client. You may be on a device where you don't have a mail client…

And don't forget the security implication that someone with access to your email can log in to your account undetected.

With traditional password reset by email, at least when I try to login next, my password won't work and I'll know something might be up and can change my email password.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#168

Post by _carl_jung » Mon, Jan 04, 2021, 6:49 PM UTC

elwell wrote: post #136

_carl_jung wrote: post #29

Earlier quoted context omitted.

Password management is better, not worse, for security.

What is your argument for that? That people will choose better passwords (unique and long) since they don't need to remember them? The Achille's heel of password managers is if someone accesses your computer (physically or remotely) they can probably access all your accounts. <-- and I've seen this happen (not to me)

This is not possible if your password manager itself requires a password. Unless you mean "password managers don't work because someone might know the master password" which is true, but realistically the alternative is just using the same weak password all over the web, which is way worse.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#169

Post by lacker » Mon, Jan 04, 2021, 7:02 PM UTC

The California DMV does this as part of their “upload documents ahead of time” system, and it is a terrible experience, because they often tell you to wait for an email and then no email arrives. What happened - is there a problem with my spam filter? Is there a backed-up queue in the DMV software? Do they simply consider it acceptable if the email takes an hour to be delivered? If you use this method then you really need to care about your email deliverability and that is harder than just maintaining a regular login process.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#170

Post by gfodor » Mon, Jan 04, 2021, 7:14 PM UTC

randomdata wrote: post #147

gfodor wrote: post #140

Earlier quoted context omitted.

Isn't the problem with this that it means your account is tied to your browser install? Eg, you'd need to copy the cert to another machine to sign in, would need to ensure it's backed up, etc.

Password management already is to basically that extent and the tools to copy that information around, backup, etc. also have come into existence to support usage beyond a single browser install.

That's half true, password management piggybacks on top of a system which doesn't have these characteristics, so it means no special work needs to be done on the development side to support them, and it's activation function is only determined on one side of each edge (the user side.) For this cert system to work, you have a bit of a chicken-and-egg problem since it requires both sides of the user-service graph to have done work pre-emptively to support it.