Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Portier – An email-based, passwordless authentication service

portier.github.io

Post reply on HN
Print view View original

41–50 of 89 posts

Re: Portier – An email-based, passwordless authentication service

#41

Post by djokkataja »

callahad wrote: post #27

Postmark just dropped our outbound email for high bounce rates. Falling back to SendGrid :/ Try again in 5 minutes. Edit: Ask HN: Any suggestions for solving this? Hitting the frontpage means people are spamming the login form with bogus addresses like a@a.com that bounce and cause trouble for us and the ESPs. Not ideal, but I'm not sure how to solve this for a small scale side-project. Discussion in https://github.c…

Why not just take the demo page down, at least for now? The concept is very simple.

Re: Portier – An email-based, passwordless authentication service

#42

Post by callahad »

danieltillett wrote: post #39
callahad wrote: post #27

Postmark just dropped our outbound email for high bounce rates. Falling back to SendGrid :/ Try again in 5 minutes. Edit: Ask HN: Any suggestions for solving this? Hitting the frontpage means people are spamming the login form with bogus addresses like a@a.com that bounce and cause trouble for us and the ESPs. Not ideal, but I'm not sure how to solve this for a small scale side-project. Discussion in https://github.c…

I think you have just discovered the fundamental flaw of your approach. My only suggestion is send the first email from your own server and if this does not bounce then send again from postmark. I used to use a telnet based approach to check if the account exists, but most servers these day don't respond with the correct error response if an account does not exist.

I'm not sure it's a fundamental flaw: it's exactly identical to sending a confirmation email when a user signs up for a website, which is considered a best practice on the Web. If that works well enough for the Web at large, it should work here, too.

As far as I can tell, the trick is building up that initial reputation and doing as much mitigation as possible up front: checking for MX records, rate limiting, soft-failing with CAPTCHAs for things that look suspicious, etc.

I know what I'll be hacking on for the rest of the week. :)

Re: Portier – An email-based, passwordless authentication service

#45

Post by Canada »

callahad wrote: post #27

Postmark just dropped our outbound email for high bounce rates. Falling back to SendGrid :/ Try again in 5 minutes. Edit: Ask HN: Any suggestions for solving this? Hitting the frontpage means people are spamming the login form with bogus addresses like a@a.com that bounce and cause trouble for us and the ESPs. Not ideal, but I'm not sure how to solve this for a small scale side-project. Discussion in https://github.c…

Depending on what kind of bounces they penalize you for, making sure the domain has a valid MX record before you send the mail might help.

Won't help if you get flooded with a bunch of invalid usernames at a big email provider, but as your volume of legitimate volume grows the bad ones should hurt less.

Re: Portier – An email-based, passwordless authentication service

#46

Post by shazow »

Is there a process for migrating to a different email address?

Let's say I used my work address to sign into a bunch of stuff, but then I leave my job and I lose access to my email address? Or say I'm migrating from using @gmail.com for everything to using my own domain?

Re: Portier – An email-based, passwordless authentication service

#47

Post by kruhft »

awinter-py wrote: post #2

Real question here is 'why isn't auth built in to the browser'. Lack of browser support is the reason oauth is so complicated (it relies on HTTP redirect to pass information around). Imagine a web experience sans cookies and sans JS. If you take into account the economics of content, it can only happen with browser-mediated login.

Auth is built into the browser[1], it's just ugly (popups) and nobody uses it.

[1] HTTP Basic Auth

Re: Portier – An email-based, passwordless authentication service

#48

Post by danieltillett »

callahad wrote: post #42
danieltillett wrote: post #39

Earlier quoted context omitted.

I think you have just discovered the fundamental flaw of your approach. My only suggestion is send the first email from your own server and if this does not bounce then send again from postmark. I used to use a telnet based approach to check if the account exists, but most servers these day don't respond with the correct error response if an account does not exist.

I'm not sure it's a fundamental flaw: it's exactly identical to sending a confirmation email when a user signs up for a website, which is considered a best practice on the Web. If that works well enough for the Web at large, it should work here, too. As far as I can tell, the trick is building up that initial reputation and doing as much mitigation as possible up front: checking for MX records, rate limiting, soft-fa…

I should have phrased this differently - it is the fundamental flaw of all email based authentication systems. Your approach is currently a bit more prone to problems since you are one nasty script away from being bounced out of existence.

Yes you need to protect the log in page by rate limiting, Captcha, looking up mx records, etc.

One approach I have thought would be good to use is a rainbow table like approach. Most people are not very imaginative about the fake email accounts they use.

Re: Portier – An email-based, passwordless authentication service

#49

Post by johannes1234321 »

qud wrote: post #44

Emails are not unique, lots of companies assign employees emails that would later be used by another person.

That is an issue not spezific to this tool. It's an issue with all tools offering "Lost password" features. Nowadays everybody should be able to get personalized mail addresses.

Re: Portier – An email-based, passwordless authentication service

#50

Post by callahad »

shazow wrote: post #46

Is there a process for migrating to a different email address? Let's say I used my work address to sign into a bunch of stuff, but then I leave my job and I lose access to my email address? Or say I'm migrating from using @gmail.com for everything to using my own domain?

Portier is an implementation detail for the websites you're using -- it doesn't do anything but validate addresses, and it doesn't have any kind of persistent database. It'd be up to the sites you're using to have some sort of address changing mechanism, just as if they were using a traditional username/password system.

One tradeoff of Portier's approach is that you can't authenticate if you lose access to your email account. This can be a pain in the ass in some cases, but beneficial in others -- pull someone from your company's LDAP and they can't represent themselves with that email address anymore. Tradeoffs :/

Post reply on HN