Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Portier – An email-based, passwordless authentication service

portier.github.io

Post reply on HN
Print view View original

61–70 of 89 posts

Re: Portier – An email-based, passwordless authentication service

#61

Post by drdaeman »

Maybe I'm heavily misunderstanding how this whole thing works, but isn't it basically a django-allauth/passport.js/omniauth/... packed as a [micro]service, with an "click link in email" for the fallback algorithm, and a planned "self-hosted" option (not sure how it would be any conceptually different from classic OpenID)?

Calling this a spiritual successor to Persona looks like a big stretch to me... Maybe I got it all wrong, though.

(And still I don't like it anyway, because my pet peeve is not having identity providers at all - one's identity must be something they can actually own, not something they lease from a provider, be it an email service or domain registrar...)

Re: Portier – An email-based, passwordless authentication service

#62

Post by StavrosK »

Sir_Substance wrote: post #35
StavrosK wrote: post #15

Earlier quoted context omitted.

The problem with that is that it breaks a user's flow too much :/ It's a good fallback, and it has many benefits, but having to switch contexts to the mail client and wait for an email is too cumbersome for the user (although it's not too bad when paired with a long-lived session). That's why Portier supports other auth providers, so you can have the best of both worlds.

>The problem with that is that it breaks a user's flow too much :/ Unironically and without rancor, would you say it breaks a users flow more or less than having to go fire up their password manager and find the service from dozens of entries? The number of services we use daily is increasing, and they just keep getting hacked. The idea of actually memorizing your password is rapidly becoming impractical. Most people…

> more or less than having to go fire up their password manager and find the service from dozens of entries?

Definitely more. All good password managers are so well integrated that the username and password are pre-filled in most sites noawadays.

> Most people these days who understand password security have either developed a personal algorithm for deriving passwords, or use a password manager for literally everything.

Yep, passwords suck.

> This is the same workflow, but without having to use notepad to stage the new "password" for entry into the confirmation field.

Exactly. This just removes all pretense.

Re: Portier – An email-based, passwordless authentication service

#63

Post by StavrosK »

drdaeman wrote: post #61

Maybe I'm heavily misunderstanding how this whole thing works, but isn't it basically a django-allauth/passport.js/omniauth/... packed as a [micro]service, with an "click link in email" for the fallback algorithm, and a planned "self-hosted" option (not sure how it would be any conceptually different from classic OpenID)? Calling this a spiritual successor to Persona looks like a big stretch to me... Maybe I got it a…

> isn't it basically a django-allauth/passport.js/omniauth/... packed as a [micro]service, with an "click link in email" for the fallback algorithm, and a planned "self-hosted" option (not sure how it would be any conceptually different from classic OpenID)?

Yes, in the same way that everything is composed of other things.

Re: Portier – An email-based, passwordless authentication service

#64

Post by callahad »

drdaeman wrote: post #61

Maybe I'm heavily misunderstanding how this whole thing works, but isn't it basically a django-allauth/passport.js/omniauth/... packed as a [micro]service, with an "click link in email" for the fallback algorithm, and a planned "self-hosted" option (not sure how it would be any conceptually different from classic OpenID)? Calling this a spiritual successor to Persona looks like a big stretch to me... Maybe I got it a…

Yes. It's multi-provider authentication as a service.

I think this matters, since it means I can run a single instance to support all of my projects, regardless of language, because everything speaks HTTP. I don't have to grapple with OmniAuth for Ruby, AllAuth for Python, Passwordless for Node, and lord knows what for experiments in Clojure, Elixir, and Rust. I don't have to set up outbound email, register social API keys, and design a hybrid login form for each of those projects, either. Set up Portier once, and I'm done. I've written more about Persona's failings and virtues at https://github.com/portier/portier.github.io/blob/master/Oth..., which might better explain why I view this as a successor.

As to Identity Providers... as long as websites utilize email addresses as a way of identifying accounts and resetting passwords, we're in the same place. Portier makes this no worse. I sympathize with the notion that identity should not be leased from a third party, but I don't know how to solve that. Blockchains? I'd encourage others to pursue that future while Portier tries to carve out an ephemeral but useful island in the present.

Re: Portier – An email-based, passwordless authentication service

#65

Post by jlgaddis »

intimatica wrote: post #54
callahad wrote: post #27

Postmark just dropped our outbound email for high bounce rates. Falling back to SendGrid :/ Try again in 5 minutes. Edit: Ask HN: Any suggestions for solving this? Hitting the frontpage means people are spamming the login form with bogus addresses like a@a.com that bounce and cause trouble for us and the ESPs. Not ideal, but I'm not sure how to solve this for a small scale side-project. Discussion in https://github.c…

What about only explicitly allowing domains that have DKIM enabled? Having that form of validation should help since DKIM was made to specifically stop email spoofing; and anyone serious about implementing Portier would understand that need. Outlook/Gmail etc aren't likely to be flagged by ESP's for the most part as those have reputation and rudimentary spoofing protection, at least more than a@a.com anyway. Persons…

In response to your other (dead) comment, "SPF" records actually are TXT records.

In the past, there was an SPF RR type but that's been deprecated.

Re: Portier – An email-based, passwordless authentication service

#66

Post by jlgaddis »

Canada wrote: post #45
callahad wrote: post #27

Postmark just dropped our outbound email for high bounce rates. Falling back to SendGrid :/ Try again in 5 minutes. Edit: Ask HN: Any suggestions for solving this? Hitting the frontpage means people are spamming the login form with bogus addresses like a@a.com that bounce and cause trouble for us and the ESPs. Not ideal, but I'm not sure how to solve this for a small scale side-project. Discussion in https://github.c…

Depending on what kind of bounces they penalize you for, making sure the domain has a valid MX record before you send the mail might help. Won't help if you get flooded with a bunch of invalid usernames at a big email provider, but as your volume of legitimate volume grows the bad ones should hurt less.

Hopefully the OP already knows this but (just in case) an MX is not required. An A RR will be tried if an MX doesn't exist.

Re: Portier – An email-based, passwordless authentication service

#67

Post by jlgaddis »

callahad wrote: post #27

Postmark just dropped our outbound email for high bounce rates. Falling back to SendGrid :/ Try again in 5 minutes. Edit: Ask HN: Any suggestions for solving this? Hitting the frontpage means people are spamming the login form with bogus addresses like a@a.com that bounce and cause trouble for us and the ESPs. Not ideal, but I'm not sure how to solve this for a small scale side-project. Discussion in https://github.c…

Do you have a plan for users whose mail server does greylisting?

Having to wait 20 minutes to receive an e-mail so that i can login would be a real PITA.

Also, "recipient verification" (which some others have managed) isn't a good long-term solution.

Re: Portier – An email-based, passwordless authentication service

#68

Post by medmunds »

callahad wrote: post #27

Postmark just dropped our outbound email for high bounce rates. Falling back to SendGrid :/ Try again in 5 minutes. Edit: Ask HN: Any suggestions for solving this? Hitting the frontpage means people are spamming the login form with bogus addresses like a@a.com that bounce and cause trouble for us and the ESPs. Not ideal, but I'm not sure how to solve this for a small scale side-project. Discussion in https://github.c…

There are a handful of (commercial) email address verification services, which could automate some of the logic for you:

* https://kickbox.io * https://www.emailhippo.com * http://www.briteverify.com

The pricing might be prohibitive for your usage. I don't know if any of them offer discounts/free usage for open source projects. (Not endorsing any of them; they've been sitting on my own list of things to investigate.)

Also, as an aside: SendGrid may not be suitable for transactional email you need delivered consistently quickly, unless you purchase their dedicated IP option. (And if you're bouncing a lot, a dedicated IP could actually be counterproductive for your delivery.) Recent incident [https://sendgrid.com/docs/Classroom/Deliver/shared_ip_thrott...] and discussion [https://news.ycombinator.com/item?id=12142728].

Re: Portier – An email-based, passwordless authentication service

#69

Post by medmunds »

medmunds wrote: post #68
callahad wrote: post #27

Postmark just dropped our outbound email for high bounce rates. Falling back to SendGrid :/ Try again in 5 minutes. Edit: Ask HN: Any suggestions for solving this? Hitting the frontpage means people are spamming the login form with bogus addresses like a@a.com that bounce and cause trouble for us and the ESPs. Not ideal, but I'm not sure how to solve this for a small scale side-project. Discussion in https://github.c…

There are a handful of (commercial) email address verification services, which could automate some of the logic for you: * https://kickbox.io * https://www.emailhippo.com * http://www.briteverify.com The pricing might be prohibitive for your usage. I don't know if any of them offer discounts/free usage for open source projects. (Not endorsing any of them; they've been sitting on my own list of things to investigate.)…

Oh, also, another resource if you want to roll your own email verification: https://www.scottbrady91.com/Email-Verification/Python-Email...

Re: Portier – An email-based, passwordless authentication service

#70

Post by scottydelta »

callahad wrote: post #27

Postmark just dropped our outbound email for high bounce rates. Falling back to SendGrid :/ Try again in 5 minutes. Edit: Ask HN: Any suggestions for solving this? Hitting the frontpage means people are spamming the login form with bogus addresses like a@a.com that bounce and cause trouble for us and the ESPs. Not ideal, but I'm not sure how to solve this for a small scale side-project. Discussion in https://github.c…

Why dont you add a captcha?
Post reply on HN