4 ms·

Here's my advice: do not use passwords. Just don't. If someone wants to log in, mail them a one time link. And make the session long enough this doesn't happen

by chx 9y ago

Here's my advice: do not use passwords. Just don't. If someone wants to log in, mail them a one time link. And make the session long enough this doesn't happen often -- when was the last time you needed to log into HN or Github? We also AES encrypt the emails with the key stored on a network share. It doesn't add a lot of complexity and if an attacker gets hold of the contents of the database, they still don't have this piece of PII. It's by no means a big hurdle against any serious attack but it's nice to have.

reallymental 9y ago
And how do I log into my email account to access this one time link? Edit: Even if it's an account held on a private server, there must be a password, must there not?
- vertex-four 9y ago
  Theoretically you could use x.509 certs and a key stored on a smartcard type device, but sure. Point is, this advice is probably aimed at developers who aren't working on email systems.
  - newscracker 9y ago
    Provisioning and maintaining the certificates/keys across even a small user base is a huge pain compared to letting users choose their own passwords.
    - vertex-four 9y ago
      Hence theoretically. :)
newscracker 9y ago
Edit: This is a decent enough solution, though it comes with its own pitfalls. How exactly are you sure that the email is encrypted and is read only by the intended receiver and not by anyone else? This is too simplistic as a solution. Things like what to do if a user clicks on the same link more than once also have to be considered (is it really the intended user who clicked it or a malicious actor that the user is not aware of?).
- mehrdadn 9y ago
  > How exactly are you sure that the email is encrypted and is read only by the intended receiver and not by anyone else? Same way you make sure that the password reset links sent to your email are only received by you and not by anyone else?
  - jakecopp 9y ago
    This! It's like everyone has already implemented email based login (password resets) but chooses more complexity by adding a password. I wish every site did this. Especially for non technical users, passwords are such a mental barrier.
- MildlySerious 9y ago
  Another big one is that this method is not entirely device agnostic. I am not able/willing to log into my email account on every device that I might want to log into your service with. One way this has been prevented for me so far is to include a one time pass in the mail along with the link, but some people might still not have a second device on hand every time they want to log in.
  - adambrenecki 9y ago
    now.sh handles this quite nicely: when you log in there, they send you an email and display three random words. When you get the email, you verify the words match, click the link, and then you'll be logged in in the original browser tab, on the original device.

by chx 9y ago

reallymental 9y ago

And how do I log into my email account to access this one time link? Edit: Even if it's an account held on a private server, there must be a password, must there not?

vertex-four 9y ago
Theoretically you could use x.509 certs and a key stored on a smartcard type device, but sure. Point is, this advice is probably aimed at developers who aren't working on email systems.
- newscracker 9y ago
  Provisioning and maintaining the certificates/keys across even a small user base is a huge pain compared to letting users choose their own passwords.
  - vertex-four 9y ago
    Hence theoretically. :)

newscracker 9y ago

Edit: This is a decent enough solution, though it comes with its own pitfalls. How exactly are you sure that the email is encrypted and is read only by the intended receiver and not by anyone else? This is too simplistic as a solution. Things like what to do if a user clicks on the same link more than once also have to be considered (is it really the intended user who clicked it or a malicious actor that the user is not aware of?).

mehrdadn 9y ago
> How exactly are you sure that the email is encrypted and is read only by the intended receiver and not by anyone else? Same way you make sure that the password reset links sent to your email are only received by you and not by anyone else?
- jakecopp 9y ago
  This! It's like everyone has already implemented email based login (password resets) but chooses more complexity by adding a password. I wish every site did this. Especially for non technical users, passwords are such a mental barrier.
MildlySerious 9y ago
Another big one is that this method is not entirely device agnostic. I am not able/willing to log into my email account on every device that I might want to log into your service with. One way this has been prevented for me so far is to include a one time pass in the mail along with the link, but some people might still not have a second device on hand every time they want to log in.
- adambrenecki 9y ago
  now.sh handles this quite nicely: when you log in there, they send you an email and display three random words. When you get the email, you verify the words match, click the link, and then you'll be logged in in the original browser tab, on the original device.