Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Are Magic Links Outdated?

zitadel.com

Post reply on HN
Print view View original

221–230 of 230 posts

Re: Are Magic Links Outdated?

#221

Post by tuetuopay »

zhfliz wrote: post #206
az_reth wrote: post #183

Earlier quoted context omitted.

Except you're still protected whenever a website gets breached and all their passwords are dumped. Sure it's still a single point of failure but at least it's with a company dedicated to password security.

how? standard TOTP MFA (which is what most password managers would offer in terms of MFA) uses a shared secret, which you would just dump from the same database you get the dumped passwords from. unless you use asymmetric crypto e.g. in webauthn this doesn't benefit you at all.

Except that the seed for the TOTP is unique to each website, because the website generates it, as opposed to an user-supplied password that might get reused across website. The impact is limited to the already compromised website, which is pretty darn good.

Re: Are Magic Links Outdated?

#222

Post by movedx »

contravariant wrote: post #112
movedx wrote: post #69

Earlier quoted context omitted.

Microsoft Authenticator - syncs your codes to the Cloud so you can pull them elsewhere (which your phone is out of action.)

Last time I tried that I still had to reactivate all the accounts. Storing them in Bitwarden is more convenient by far, but storing TOTP is a paid feature.

I use 1Password, but I'm not sure storing the OTP next to the password is a good idea?

Re: Are Magic Links Outdated?

#223

Post by ignoramous »

mooreds wrote: post #37

Another issue that I don't see covered here is that some email clients (looking at you, Outlook) pre-fetch links to see if they are security risks. If you build a magic link system which handles plain old GETs, the one time code gets used up before the user can actually log in. We ran into this at FusionAuth and had to do implement some workarounds, documented here: https://github.com/FusionAuth/fusionauth-issues/iss…

I always say this to CISO-types: FusionAuth SimplePass is the real magic, not magic links; https://fusionauth.io/blog/2021/04/01/fusionauth-introduces-... elegant and yet zero attack vec

Re: Are Magic Links Outdated?

#224

Post by contravariant »

movedx wrote: post #222
contravariant wrote: post #112

Earlier quoted context omitted.

Last time I tried that I still had to reactivate all the accounts. Storing them in Bitwarden is more convenient by far, but storing TOTP is a paid feature.

I use 1Password, but I'm not sure storing the OTP next to the password is a good idea?

The idea is that you protect your password vault with 2FA and a strong password.

It slightly raises the risk in the scenario where your password vault gets hacked, but like with putting all your passwords in the same place, if you've only got 1 place to protect it becomes easier to protect it more thoroughly.

Re: Are Magic Links Outdated?

#225

Post by Joker_vD »

snovv_crash wrote: post #125
Joker_vD wrote: post #46

Earlier quoted context omitted.

It's actually pretty insane: there is a setting on Android to always use the main browser (Chrome) to open links, I've turned it on, and yet the Gmail app still opens the links in the embedded Chrome browser — which has different cookies, different history that apparently is not synced with my other Chromes, and even looks sli-i-ightly different than "normal" Chrome, somehow. I've no idea why it is so difficult for a…

Uninstall chrome and use Firefox, and it works for me with full cookie sharing. There is even an "open in Firefox" in the hamburger drop-down which transfers the page to the browser app without reloading.

Last time I tried Firefox on my Android phone it showed weird drawing artifacts (half/quarter of the page is full black) on pretty must all websites, so thanks for your suggestion but I'd stick with an actually working browser.

In any case, I don't need to bother about whether any "cookie sharing" works or not if I only use one browser, do I?

Re: Are Magic Links Outdated?

#226

Post by ben_w »

rambambram wrote: post #137
roelschroeven wrote: post #56

Earlier quoted context omitted.

Some third party detects you're trying to sign into a website. The third party sends you an email, that email happens to arrive first. You click the link in the email. Now you're on a website that looks like the one you expected (if the third party has done its homework) but is completely in control by the third party. Apparently things like this do happen, for example when people are buying or selling things on the…

> Some third party detects you're trying to sign into a website. And this third party can find out how, exactly?

Off the top of my head, even in HTTPS the domain name isn't encrypted, which may be enough to make a good guess.

Or possibly just guessing without evidence because the sending cost of junk email is so low — looking at my junk mail folders, I have reason to believe they guess.

FWIW, I've heard of this type of attack (deliberately timed) being used during house purchases, with a fake destination bank message preceding the real message by a few minutes. Does anyone know if that's real or just an urban legend?

Re: Are Magic Links Outdated?

#227

Post by smt88 »

tomc1985 wrote: post #173
smt88 wrote: post #163

Earlier quoted context omitted.

> Am I the only person taht doesn't have my email open in another tab? Magic links aren't targeted at the type of user you seem to be. Most users of most products are: 1) on mobile devices, and 2) use a native email client. They also don't have password managers, so magic links become a way to assume the security level of their personal email (which is what "forgot password" ends up doing anyway).

It doesn't matter. Crap like this makes the web worse. We cannot keep catering to people who refuse to learn better practices. If the industry got itself together enough to start teaching people good internet hygiene we'd all be much better off. But instead we strip away OK security for horrible security, and inconvenience nearly everyone in the process.

Magic links are better security than most people's use of passwords.

I can't count the number of people I know who reuse the same password on every site or just use terrible passwords. It took me years to get my dad and girlfriend on a password manager, and they're the only family I've succeeded with.

It's the same with privacy. I could never get anyone to leave Gmail. You can't sell people on a major "inconvenience" by telling them about a hypothetical security breach. It's just not human nature.

And even worse, the only good password manager that I've used is 1Password and it isn't free.

Re: Are Magic Links Outdated?

#228

Post by rambambram »

ben_w wrote: post #226
rambambram wrote: post #137

Earlier quoted context omitted.

> Some third party detects you're trying to sign into a website. And this third party can find out how, exactly?

Off the top of my head, even in HTTPS the domain name isn't encrypted, which may be enough to make a good guess. Or possibly just guessing without evidence because the sending cost of junk email is so low — looking at my junk mail folders, I have reason to believe they guess. FWIW, I've heard of this type of attack (deliberately timed) being used during house purchases, with a fake destination bank message preceding…

Ah, like that you mean. Thanks. I was thinking of embedded third party code on a website (which might better not be included on sensitive pages).

Re: Are Magic Links Outdated?

#229

Post by bradgessler »

mszary wrote: post #207
aaaaaaaaaaab wrote: post #200

Earlier quoted context omitted.

So you actually agree with me. 1. I don’t have any problem with OTP-based magic links, if they’re implemented carefully. As you’ve just demonstrated, a 6-digit OTP with 3 retries allowed is not sufficient at scale. 2. I’ve also demonstrated that OP’s proposal to augment the 6-digit code with a “secret” token gives you no additional security. It can only protect against someone peeking over your shoulder to snatch you…

Seems like it :) but I would be more pragmatic and didn't bash the system for the reasons you brought up :) ad 1 - IMO, it's still sufficient at scale with some basic infra. hardening ad 2 - AFAIK the "secret" was never meant to protect from brute-force, but rather mitigate threats from actors controlling the email part ad 3 - again, let's be more pragmatic - no one would use it if it required typing 13-letters OTP :…

OP here… this was a great thread. Here’s a few takeaways, which you may not like, but I think are worth writing out.

1. This def needs hardening. I currently only use it for really low stakes stuff. I need to make that clearer in the README.

2. The next level of hardening I was planning on implementing is rate limiting code requests per email address. I figure I can step up the time-outs between code requests pretty aggressively to slow down brute forcing the code. The ATM that eats the card is a great analogy.

3. Maybe I missed it in the thread, but nobody mentioned that this from of auth makes it evident to the persons being attacked that something is happening if they have a bajillion code requests in their email inbox. There’s a lot of other problems that creates for these auth scheme, like filling a users inbox beyond its quota, triggering high volume breakers for SMTP relay services like AWS SES, etc. that wouldn’t be good.

For those watching, if you’re a security researcher feel free to open a GitHub issue on that repo and I’ll address it.

Re: Are Magic Links Outdated?

#230

Post by pritambaral »

IggleSniggle wrote: post #90
pritambaral wrote: post #63

Earlier quoted context omitted.

> Mobile email clients use their own browser and cookie jar which consume the session cookie you're trying to put into the user's main browser. This results in users 'never staying signed in' and a lot of frustration. The earliest Magic Links I remember using didn't have this problem, and this was before smartphones. The Link, back then at least, was only to authenticate that you can receive emails at a certain mailb…

As a user the problem I run into with some frequency is passwordless login where the waiting session loses its “waiting” status because I switched the active application in iOS from my browser to my email and back again. When I get back, the page for whatever reason (refresh after being backgrounded?) requires a new auth attempt. A wrinkle in this complaint is that in most scenarios I don’t especially want a browser…

This took me a bit of time to realise, but well-designed software can avoid this problem rather simply: Combine the Magic Link with a short-code that can be manually typed into the browser session attempting to login. This short-code can then be prominently displayed in the email header and/or early on in the email body, so a user can simply read it off the notification that the email would generate. No need to switch apps from browser to email.
Post reply on HN