[dead]
The "email is authentication" pattern
441–450 of 474 posts
Re: The "email is authentication" pattern
#442Email accounts are the highest common denominator in online authentication. Phones are competitive, but people lose phones. Phone numbers are more common and durable, but the security of phone numbers is leagues below that of a flagship provider email account. It makes sense that so many authentication flows work this way. When designing a "fantasy football" alternate authentication system for the Internet, start wit…
> If the answer is "they just don't get access anymore" or "a panel of their peers attests to them", your fantasy authentication system also needs a fantasy species of sentient beings to serve as users, because it won't work for humans. This has been my single biggest argument against blockchain/cryptocurrency stuff for years: the "lose your key, lose your wallet" thing is fundamentally incompatible with real users.…
With current currencies you don't have an option, you HAVE to give your money to banks and accept its consequences, like losing privacy, risk of have it frozen, etc.
With cryptocurrencies at least you have an option, you can leave it at a custodial wallet that can manage some of the security for you or you can have a non-custodial wallet.
Re: The "email is authentication" pattern
#443We run a pretty unserious business. That is, our users use our accounts only out of convenience. The system we've settled on is this: 1. User enters email 2. We send a verification code to their email 3. User enters code, is signed in "indefinitely" (very, very long cookie) Whether or not they had an account before hand is irrelevant, we just register a new account if the email is new. The occasional user has multipl…
I have seen some logins like this, can't you just send a link in the email that sends you to the app home and you're logged in already?
I find it a hassle to copy the code, finding the right tab where I left the login page and pasting the code to login.
Re: The "email is authentication" pattern
#444Earlier quoted context omitted.
> Most people do not want to do this Yes, and I think that's not because they don't want to do it but because: 1) they don't know that they should do this; 2) they don't know why should they do this; 2) they don't know how to do this; 3) because even the systems marketed as current state-of-art (Passkeys) are poorly designed and don't even allow to have proper 3-2-1 backups conveniently (can't enroll a device sitting…
> We manage to explain people to not poke with scissors into electrical outlets (and make it hard to do so accidentally) - we can manage similar stuff with computers too. I don't think this is a good analogy, because the example is simply warning people of a thing not to do. It takes no effort. Maintaining backups does take effort. This is more like getting people to pick up a new chore, just like how many people see…
I strongly disagree, but I feel that the conversation would be pointless fight of beliefs, unless I actually design and showcase a solution that would be simple yet secure (and I don't want anything that takes effort) - but that will take me a while to work on.
The idea is that user shouldn't have any friction, besides meeting minimal requirements: 1) being capable of reading (or otherwise accessing the text) and comprehending simple instructions; and 2) having certain minimally required hardware or software installed.
I'm sure this is doable and every primitive to build this already exists and vetted by competent people. I'm sure it's possible for a layman non-technical person with normal cognitive capabilities to have a safe authentication solution (which is very different from data backups) with full ownership of their identities and credentials.
Sure there are people that cannot read or cannot comprehend things. A lot of people. I've seen way too many folks who had simple and clear ELI5-grade instructions with zero technical jargon - and nonetheless had failed to follow them because "computers hard". In some case it's the fault of UI or UX, but I strongly believe in most cases it's just learned helplessness - "computers are not my thing and they're hard" and brain shuts off instead of even trying to read. The only solutions are to 1) make them actually interested in achieving their goals (worked for my dad - man went from "I don't know and don't understand [and 'I don't want to' in the tone], order this for me" to suddenly figuring it all out and placing online orders in just a few minutes as soon as he actually needed something when I wasn't around to help), and 2) make sure they have all materials accessible, well structured and covering as many possible scenarios as possible so it's all there the moment they snap out of their learned helplessness. Nothing else works as it is fundamentally impossible to design anything that would work even if people don't read and don't think.
I have some sketches in my mind, specifically focusing on use by laypeople without making compromises about fundamentals (like what is identity - a lot of modern auth perverts this concept badly). I'll give it a try someday, actually drawing it all and writing notes on the inner workings. Wish there'd be a ten of me and we'd have 240 hours a day... Sorry.
> This is demonstrated by the choices that people have repeatedly made.
I'm afraid this is a very bad attitude to follow. The choices people had repeatedly made got us in quite a bad place. Just look at the poster child - IoT - it's a complete disaster. Online auth is in a very similar poor and messed up state, it just less visible.
Re: The "email is authentication" pattern
#445Earlier quoted context omitted.
I worked on email delivery systems. Your comment makes me realize that something that was free and trivial in the 90s is now painfully complex and expensive, because of monopolistic practices and spammers. We ruined something great.
A lot of email reputation at this point, in fact I'd say most of it, is FUD. Here is a current example I am a hostage of: Sys4 (an ESP) uses Abusix as a reputation service. Because this is poorly thought out (I've been a member of the mailing list for many years) I can't unsubscribe from the postfix-users@ mailing list (can't post either). Ok that's weird and funny in a way. We could talk about Sys4's procedural fail…
So had the call, none of the essential facts were disputed. The person I spoke with doesn't think Sys4 is using the feed in the way intended and they're going to check on that. I connected with them on LinkedIn so we might not be on the same side of this issue but we're on speaking terms.
Re: The "email is authentication" pattern
#446[dead]
Re: The "email is authentication" pattern
#447Earlier quoted context omitted.
> We manage to explain people to not poke with scissors into electrical outlets (and make it hard to do so accidentally) - we can manage similar stuff with computers too. I don't think this is a good analogy, because the example is simply warning people of a thing not to do. It takes no effort. Maintaining backups does take effort. This is more like getting people to pick up a new chore, just like how many people see…
I strongly disagree, but I feel that the conversation would be pointless fight of beliefs, unless I actually design and showcase a solution that would be simple yet secure (and I don't want anything that takes effort) - but that will take me a while to work on. The idea is that user shouldn't have any friction, besides meeting minimal requirements: 1) being capable of reading (or otherwise accessing the text) and com…
I think we may be passing as ships in the night a little bit - that is, I thought we were talking about cryptocurrency wallets, and the merits of a system with authentication relying entirely on cryptographic secrets.
I wish you luck in your development of such a system. I don't disagree with anything you said about learned helplessness, and I think it can be fruitful to push individuals or groups to overcome it, but I think trying to do that to the general populace is like trying to change the wind.
Re: The "email is authentication" pattern
#448[dead]
Re: The "email is authentication" pattern
#449At this point why not just pass a one-time url link to your email address, and have it be a single click to login? Have it expire within 10 mins if not used, and be one-time use disposable. Still, anyone who has the link initially should be able to login with your account - but it's only accessible from your email. Obliterates all sense of security beyond the email account itself, but that's where we're at anyway. Do…
I love when sites do only that and then fail to deliver an email within 30 seconds. a message to your phone "click to authenticate login Should be both code and a link (enter 1234 or click ), because it’s not always the phone you’re loggin in on.
Agreed. Do password login option too if you remember it - all work - but point being just make it a giant "LOGIN HERE" button that just does the thing as mindlessly as possible.
Re: The "email is authentication" pattern
#450At this point why not just pass a one-time url link to your email address, and have it be a single click to login? Have it expire within 10 mins if not used, and be one-time use disposable. Still, anyone who has the link initially should be able to login with your account - but it's only accessible from your email. Obliterates all sense of security beyond the email account itself, but that's where we're at anyway. Do…
Some sites do that, like Netdata. But it's slow compared to my PW manager just autofilling a user/PW combo, since I have to wait for the email and go click the link.
Oh I dont mean do it instead of passwords (if you remember them), but just as an alternative to the Forget Password or Authenticate dialogs using security codes. Should just be a "LOGIN HERE" mashable button