Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why aren't one-time sign in links more popular for authentication?

news.ycombinator.com

Post reply on HN
Print view View original

31–40 of 198 posts

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#31

Post by jwr »

Oh, this is so terrible. I hate this approach with a passion.

E-mail is NOT INSTANTANEOUS. It was never meant to be. It happens to arrive quickly for most people most of the time, but you should never, ever, base a service on that.

Many systems have greylisting in place: a new sender gets a 4xx reply, and is allowed through only on subsequent retries after a pre-set time period. This is often as much as 30-60 minutes. It's a good approach to reduce spam, it turns out a lot of spamming software does not bother to retry, or doesn't want to incur the cost.

So, if you try this OTP-over-Email approach, you end up with frustrated customers, who 1) have to wait up to 60 minutes, 2) their OTP doesn't work, because you expired it after 5 minutes.

It's terrible. Don't do it.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#32

Post by ss64 »

starbugs wrote: post #11

We have tried this for a while and the following reasons made us kill it: 1. Email delivery latency: depending on the service you use, the time it takes to deliver emails to the user can vary. Worst case I encountered was up to 20 minutes delay when there were issues with Mailgun. 2. Usability: you have to leave your current app and switch to your mail client. You may be on a device where you don't have a mail client…

20 minutes delay! Ha my worst is about 10 days.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#34

Post by starbugs »

ss64 wrote: post #32
starbugs wrote: post #11

We have tried this for a while and the following reasons made us kill it: 1. Email delivery latency: depending on the service you use, the time it takes to deliver emails to the user can vary. Worst case I encountered was up to 20 minutes delay when there were issues with Mailgun. 2. Usability: you have to leave your current app and switch to your mail client. You may be on a device where you don't have a mail client…

20 minutes delay! Ha my worst is about 10 days.

I guess we got lucky then? It doesn't seem to make a big difference though. After a couple of minutes most users considered the login attempt failed in our cases.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#35

Post by Veen »

OJFord wrote: post #17

As a user, I hate it, it's a PITA, why be different, 'everyone' 'understands' passwords, we expect them.

> why be different

Because, although everyone understands passwords, they have security and customer experience issues:

- Users choose easily guessed passwords and get hacked.

- They use the same passwords on multiple services and get hacked.

- They forget passwords, requiring an email reset, so they need to access their email anyway.

- The service doesn't need to store and manage passwords.

Every authentication method involves tradeoffs, and the service has to decide which set of tradeoffs they prefer. Personally, I prefer passwordless logins, but I understand why they're annoying for some.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#36

Post by sgt »

compsciphd wrote: post #23

In Israel a lot of services are tied to an SMS based OTP (including government services), so one doesn't even leave the app. the app reads the token out of the SMS and fills itself in (of course if that fails, you can still enter it manually).

On the Mac, Safari has that built in, if you get an SMS (delivered to the same Messages app as iMessage), the browser knows about it and you just select "Use 1234 from Messages".

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#37

Post by mjl- »

i'm using this approach for a project (for a customer) where they don't want their users sharing their login details (username/password) with others. so it's a way to keep some control over who is accessing the system. the assumption is that people won't share credentials for their mailbox with others.

email is still mostly sent as plain text over the internet, that's certainly a downside.

email delays haven't been a problem in practice for us.

we also send users notification emails with links going directly to the right page, automatically logging the user in. i would like that from other services as well, as i'm browsing with ephemeral browser containers. having a clean browser environment triggers some website (eg github) to verify my login with a unique code sent by email. that indicates email delays aren't a showstopper in practice at big scale either.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#40

Post by progval »

jwr wrote: post #31

Oh, this is so terrible. I hate this approach with a passion. E-mail is NOT INSTANTANEOUS. It was never meant to be. It happens to arrive quickly for most people most of the time, but you should never, ever, base a service on that. Many systems have greylisting in place: a new sender gets a 4xx reply, and is allowed through only on subsequent retries after a pre-set time period. This is often as much as 30-60 minutes…

As a user, I have the same issue but in the opposite direction. My greylisting config requires only 1 minute wait, but many providers only retry after 5-10 minutes.

Usually I can request a new login (or email verification) link and it will go through immediately. It does not work with Sendgrid-based services though, as Sendgrid rotates the IP used by the service for every mail.

Post reply on HN