4 ms·

From the article: > I'm referring to passwordless solutions that involves things like QR codes, pictorial representations, 3rd party mobile apps, dedicated har

by rocqua 8y ago

From the article: > I'm referring to passwordless solutions that involves things like QR codes, pictorial representations, 3rd party mobile apps, dedicated hardware devices or "magic" links sent via email. I'm not entirely sure the argument holds for the magic links sent via email. To me, those feel like lower friction that entering a password. Because all of a sudden, users don't have to remember their password. For any company considering this, I'd suggest looking at how often the 'forgot my password please send me an email' feature is used. I know that, before I had a password manager, there were accounts where I simply never remembered my password. I had to use them like once every month, and it was easier to just get the password reset link. Now consider how much easier a 'click here and be logged in' link is than a password reset system. This only really gives friction for those few people who aren't always connected to their e-mail system. On account creation, this system is even better. All a user needs to enter is their e-mail address. No more needing to enter a password (twice!). No more dealing with password requirements. "magic" e-mail links feel like they really could be a password killer in terms of lower friction. However, it isn't clear at all that "magic" e-mail links are more secure than passwords. I'd guess that, given enough adoption, they'd develop some issues.

ryan-c 8y ago
There are some minor issues with the magic link workflow - one of them is security scanning software potentially visiting the link. So then you need to open the link in the same browser you want to use. But what if you want to log in on a desktop browser and only have your email on your phone? Maybe have the magic link show a couple letters you need to type into the browser?
- comma-ampersand 8y ago
  You might as well email them the letters.
- BillinghamJ 8y ago
  They are trivially solvable problems. PKCE and just displaying a QR code if you open it on the wrong device makes it pretty much foolproof. e.g.: https://magic.cuvva.com/auth-callback?code=authzcode_000000BUbZIHZJMzS8f4NLD7tmltY.fa5e2579d6693016765cf04d2c69b3a58785352591244b69c0e04f3c0e5411ce&state=Ijn8I4qQr6HqfG0kxh05rsLmF4IqB3JNchgpbSRR7HY https://magic.cuvva.com/auth-callback?code=authzcode_000000B... We're oriented around mobile use cases. Admittedly less ideal if you don't have your email on your desktop. But ultimately, if all else fails, you can always log into your webmail. For me the key thing is that it doesn't rely on users having any particular knowledge or understanding best practices - they just need to hit the big green button. Sure people are more used to passwords, but that doesn't mean the usability of magic links isn't still better despite them being much less common. Normal people are so bad at dealing with passwords. They reuse them, they forget them, they write them down on text files on their computer. Almost anything is better if your userbase isn't primarily technically adept people. And frankly most popular email providers are pretty good at keeping the accounts secure. Likely much better than anything homegrown we could do. Especially given the fact that you'll just end up having password resets via email anyway.
  - Lukas_Skywalker 8y ago
    > They reuse them, they forget them, they write them down on text files on their computer. Writing them down in a textfile on the computer might not even be that bad _if_ they, as a consequence, are not or less reused.
  - rocqua 8y ago
    The QR-code thingy hits a friction barrier. For me needing to go to my phone is more friction than unlocking my password manager. Note that I only need to unlock my password manager once per reboot, and that for most people the password manager is already too much friction.
    - BillinghamJ 8y ago
      You'd only use the QR code thing if you were logging into an app on your phone, but had opened the email on your laptop. It wouldn't make sense in the other direction.
  - AgentME 8y ago
    Does this work for the case you have your email on your phone but you want to use the site on a computer? That seems more likely to me than the case that you have your email on your computer only, but it is neat to see that case addressed.
    - BillinghamJ 8y ago
      Yeah it's a fair point. The case I mentioned is for Cuvva, which currently is mobile-only. Webmail is always a decent backup option though, so doesn't give me too much concern in terms of people getting stuck. But may be a little less seamless, particularly if they're using a shared/public computer. That scenario throws password managers out of the window too though.
- rocqua 8y ago
  > one of them is security scanning software potentially visiting the link. I gave it some thought, and that seems to be solvable. Have the link go to a 'confirm' page, where the confirm button performs a post request. If security scanning software is randomly hitting post requests, that is just totally ridiculous. What seems a lot more scary to me is the plaintext nature of e-mail. Even SMTP over TLS doesn't keep any end-points from reading your email, and I'm guessing there is a small but significant set of people who'se email providers don't run TLS. Besides, if someone can recognize that any request is underway for a login, they might intercept it and send a phishing fake.
ukulele 8y ago
We've had "magic" links as the primary sign in method for our site for about a year now. It works well but we very regularly get requests to allow password login. So much so that we'll introduce that eventually. Seems like both in combo could be a nice solution, but I'm sure we'll just start getting support requests from people whose password doesn't work because they never set one...
- ikornaselur 8y ago
  Interestingly, we replaced our login with magic links only over a year ago. We have roughly 1600-2000 active users, and as far as I know, we've never had anyone request a password login. Not that I think about it.. it's kinda suspicious that no one has asked for it in all this time. Hmm..
  - ngrilly 8y ago
    Did you have issues with delayed email delivery (the user wants to login but the email is delayed because of some grey listing or some network glitch)?
- ngrilly 8y ago
  Did you have issues with delayed email delivery (the user wants to login but the email is delayed because of some grey listing or some network glitch)?
  - ukulele 8y ago
    No, we use Postmark which delivers very fast.
    - ngrilly 8y ago
      We use Mailgun which delivers quite fast, but we noticed that some customers, especially the big companies with an IT department running its own email server, tend to have some form of greylisting: if it is the first time they receive an email from our system, then they refuse it temporarily, and ask our system to retry in (for example) 5 minutes. Mailgun manages this nicely, but during those 5 minutes, the user is still waiting his/her magic link.
spamfilter247 8y ago
"... friction for those few people who aren't always connected to their e-mail system." I'm not sure the size of this population is well understood to be able to label them as "few" - it may be few for a given set of services, but may be many for a different set of services.
calhoun137 8y ago
This. I think Slack is doing this perfectly, they still use passwords but emphasize the magic link email. I find it a lot easier to just use the magic link the first time I join a new slack. Then once you are logged in you basically never need to log out and if you ever need to reset the password its just a click away.

by rocqua 8y ago

ryan-c 8y ago

There are some minor issues with the magic link workflow - one of them is security scanning software potentially visiting the link. So then you need to open the link in the same browser you want to use. But what if you want to log in on a desktop browser and only have your email on your phone? Maybe have the magic link show a couple letters you need to type into the browser?

comma-ampersand 8y ago
You might as well email them the letters.
BillinghamJ 8y ago
They are trivially solvable problems. PKCE and just displaying a QR code if you open it on the wrong device makes it pretty much foolproof. e.g.: https://magic.cuvva.com/auth-callback?code=authzcode_000000BUbZIHZJMzS8f4NLD7tmltY.fa5e2579d6693016765cf04d2c69b3a58785352591244b69c0e04f3c0e5411ce&state=Ijn8I4qQr6HqfG0kxh05rsLmF4IqB3JNchgpbSRR7HY https://magic.cuvva.com/auth-callback?code=authzcode_000000B... We're oriented around mobile use cases. Admittedly less ideal if you don't have your email on your desktop. But ultimately, if all else fails, you can always log into your webmail. For me the key thing is that it doesn't rely on users having any particular knowledge or understanding best practices - they just need to hit the big green button. Sure people are more used to passwords, but that doesn't mean the usability of magic links isn't still better despite them being much less common. Normal people are so bad at dealing with passwords. They reuse them, they forget them, they write them down on text files on their computer. Almost anything is better if your userbase isn't primarily technically adept people. And frankly most popular email providers are pretty good at keeping the accounts secure. Likely much better than anything homegrown we could do. Especially given the fact that you'll just end up having password resets via email anyway.
- Lukas_Skywalker 8y ago
  > They reuse them, they forget them, they write them down on text files on their computer. Writing them down in a textfile on the computer might not even be that bad _if_ they, as a consequence, are not or less reused.
- rocqua 8y ago
  The QR-code thingy hits a friction barrier. For me needing to go to my phone is more friction than unlocking my password manager. Note that I only need to unlock my password manager once per reboot, and that for most people the password manager is already too much friction.
  - BillinghamJ 8y ago
    You'd only use the QR code thing if you were logging into an app on your phone, but had opened the email on your laptop. It wouldn't make sense in the other direction.
- AgentME 8y ago
  Does this work for the case you have your email on your phone but you want to use the site on a computer? That seems more likely to me than the case that you have your email on your computer only, but it is neat to see that case addressed.
  - BillinghamJ 8y ago
    Yeah it's a fair point. The case I mentioned is for Cuvva, which currently is mobile-only. Webmail is always a decent backup option though, so doesn't give me too much concern in terms of people getting stuck. But may be a little less seamless, particularly if they're using a shared/public computer. That scenario throws password managers out of the window too though.
rocqua 8y ago
> one of them is security scanning software potentially visiting the link. I gave it some thought, and that seems to be solvable. Have the link go to a 'confirm' page, where the confirm button performs a post request. If security scanning software is randomly hitting post requests, that is just totally ridiculous. What seems a lot more scary to me is the plaintext nature of e-mail. Even SMTP over TLS doesn't keep any end-points from reading your email, and I'm guessing there is a small but significant set of people who'se email providers don't run TLS. Besides, if someone can recognize that any request is underway for a login, they might intercept it and send a phishing fake.

ukulele 8y ago

We've had "magic" links as the primary sign in method for our site for about a year now. It works well but we very regularly get requests to allow password login. So much so that we'll introduce that eventually. Seems like both in combo could be a nice solution, but I'm sure we'll just start getting support requests from people whose password doesn't work because they never set one...

ikornaselur 8y ago
Interestingly, we replaced our login with magic links only over a year ago. We have roughly 1600-2000 active users, and as far as I know, we've never had anyone request a password login. Not that I think about it.. it's kinda suspicious that no one has asked for it in all this time. Hmm..
- ngrilly 8y ago
  Did you have issues with delayed email delivery (the user wants to login but the email is delayed because of some grey listing or some network glitch)?
ngrilly 8y ago
Did you have issues with delayed email delivery (the user wants to login but the email is delayed because of some grey listing or some network glitch)?
- ukulele 8y ago
  No, we use Postmark which delivers very fast.
  - ngrilly 8y ago
    We use Mailgun which delivers quite fast, but we noticed that some customers, especially the big companies with an IT department running its own email server, tend to have some form of greylisting: if it is the first time they receive an email from our system, then they refuse it temporarily, and ask our system to retry in (for example) 5 minutes. Mailgun manages this nicely, but during those 5 minutes, the user is still waiting his/her magic link.

spamfilter247 8y ago

"... friction for those few people who aren't always connected to their e-mail system." I'm not sure the size of this population is well understood to be able to label them as "few" - it may be few for a given set of services, but may be many for a different set of services.

calhoun137 8y ago

This. I think Slack is doing this perfectly, they still use passwords but emphasize the magic link email. I find it a lot easier to just use the magic link the first time I join a new slack. Then once you are logged in you basically never need to log out and if you ever need to reset the password its just a click away.