Why Login Security Sucks
matduggan.com
Why Login Security Sucks
1–10 of 81 posts
Re: Why Login Security Sucks
#2A website that allows login via forgot password -> send email -> reset password should skip passwords entirely and use magic links instead.
Also, at this point there’s a huge number of previously leaked passwords. So websites should simply not allow passwords that have appeared in those leaks.
Re: Why Login Security Sucks
#3A website that allows login via forgot password -> send email -> reset password should skip passwords entirely and use magic links instead. Also, at this point there’s a huge number of previously leaked passwords. So websites should simply not allow passwords that have appeared in those leaks.
Magic links are annoying for users.
Re: Why Login Security Sucks
#4A website that allows login via forgot password -> send email -> reset password should skip passwords entirely and use magic links instead. Also, at this point there’s a huge number of previously leaked passwords. So websites should simply not allow passwords that have appeared in those leaks.
Magic links are annoying for users.
I always forget how stinking nice password manager autofill is until I have to fight with magic links because some service hates me. And most implementations I've seen only log you in from the new link the email sent, not the original page. So if you are trying to log in on a device your email isn't signed in on, you get to type the entire thing in on your second device.
Re: Why Login Security Sucks
#5A website that allows login via forgot password -> send email -> reset password should skip passwords entirely and use magic links instead. Also, at this point there’s a huge number of previously leaked passwords. So websites should simply not allow passwords that have appeared in those leaks.
I absolutely hate the magic links :S
A whole bunch of AI companies are going that route where you can’t have a password and login via magic links - eg Perplexity
Re: Why Login Security Sucks
#6Earlier quoted context omitted.
Magic links are annoying for users.
I always forget how stinking nice password manager autofill is until I have to fight with magic links because some service hates me. And most implementations I've seen only log you in from the new link the email sent, not the original page. So if you are trying to log in on a device your email isn't signed in on, you get to type the entire thing in on your second device.
More times than I would like, I have had to manually type out some ludicrously long secret key/token/url. Could we please standardize on only using long strings that do not require il1o0 in them? I suppose it is a failure of Latin or the default fonts with which I am frequently stuck, but it would save me a minor bit of life aggravation.
Re: Why Login Security Sucks
#7I know that crypto/blockchain is not super popular here, but the experience of logging-in to various dapps is pretty nice.
The ”login” is the dapp showing the user a message to sign to prove they own the key, then you can sign the message, and that’s the whole login.
There’s various ways to implement it, but here’s a quick tutorial for doing login with MetaMask. https://docs.metamask.io/wallet/how-to/sign-data/siwe/
Re: Why Login Security Sucks
#8I know that crypto/blockchain is not super popular here, but the experience of logging-in to various dapps is pretty nice. The ”login” is the dapp showing the user a message to sign to prove they own the key, then you can sign the message, and that’s the whole login. There’s various ways to implement it, but here’s a quick tutorial for doing login with MetaMask. https://docs.metamask.io/wallet/how-to/sign-data/siwe/
There is no less attractive use of blockchain tech than login. The biggest problem with login security isn't attesting to an identity, it's account recovery; blockchains make that incredibly difficult.
Re: Why Login Security Sucks
#9I know that crypto/blockchain is not super popular here, but the experience of logging-in to various dapps is pretty nice. The ”login” is the dapp showing the user a message to sign to prove they own the key, then you can sign the message, and that’s the whole login. There’s various ways to implement it, but here’s a quick tutorial for doing login with MetaMask. https://docs.metamask.io/wallet/how-to/sign-data/siwe/
Ah, the crypto industry known for being exceptionally secure in their practices, always vetting their security, and never cutting corners. We should do what they do.
(Don't ask about what happened to the Ronin Network, Poly Network, FTX, Coincheck, etc, etc)
Re: Why Login Security Sucks
#10This person is wildly overthinking their problems.
Early in the piece, they marvel that it's somehow OK to email magic login links to people, but not to SMS logins. Yes: among other reasons, that's because there's nobody an attacker can realistically call on the phone or bribe at a neighborhood cell phone store to rehome an email account. Nobody wants to do away with SMTP more than I do, but everybody has it, and most people (by an overwhelming majority) host it with their absolute most secure provider.
Get past the SMS/SMTP thing. You're doing a low-sensitivity CMS application. It would be bizarre for you to have a Passkeys implementation. It's even weird for you to do login-with-Google or SIWA. Just mail magic links! Be done with it!
TOTP is dead tech. Implement the full gamut of OIDC provider logins --- most of which have better TOTP implementations than you'll come up with (but also tend to steer their users away from TOTP) and forget that it exists.
I'd like to have a coda here about how things get much harder if you're a high-sensitivity application. But they don't. Mostly what happens is that OIDC signon gets much more important.
The bit about TOTP secrets being worse, harder-to-rotate passwords also misses the point of why passwords are bad and why unmasked TOTP seed storage is not in fact that big of a deal, but who cares? Just don't do TOTP.