4 ms·

There are some minor issues with the magic link workflow - one of them is security scanning software potentially visiting the link. So then you need to open th

by ryan-c 8y ago

There are some minor issues with the magic link workflow - one of them is security scanning software potentially visiting the link. So then you need to open the link in the same browser you want to use. But what if you want to log in on a desktop browser and only have your email on your phone? Maybe have the magic link show a couple letters you need to type into the browser?

comma-ampersand 8y ago
You might as well email them the letters.
BillinghamJ 8y ago
They are trivially solvable problems. PKCE and just displaying a QR code if you open it on the wrong device makes it pretty much foolproof. e.g.: https://magic.cuvva.com/auth-callback?code=authzcode_000000BUbZIHZJMzS8f4NLD7tmltY.fa5e2579d6693016765cf04d2c69b3a58785352591244b69c0e04f3c0e5411ce&state=Ijn8I4qQr6HqfG0kxh05rsLmF4IqB3JNchgpbSRR7HY https://magic.cuvva.com/auth-callback?code=authzcode_000000B... We're oriented around mobile use cases. Admittedly less ideal if you don't have your email on your desktop. But ultimately, if all else fails, you can always log into your webmail. For me the key thing is that it doesn't rely on users having any particular knowledge or understanding best practices - they just need to hit the big green button. Sure people are more used to passwords, but that doesn't mean the usability of magic links isn't still better despite them being much less common. Normal people are so bad at dealing with passwords. They reuse them, they forget them, they write them down on text files on their computer. Almost anything is better if your userbase isn't primarily technically adept people. And frankly most popular email providers are pretty good at keeping the accounts secure. Likely much better than anything homegrown we could do. Especially given the fact that you'll just end up having password resets via email anyway.
- Lukas_Skywalker 8y ago
  > They reuse them, they forget them, they write them down on text files on their computer. Writing them down in a textfile on the computer might not even be that bad _if_ they, as a consequence, are not or less reused.
- rocqua 8y ago
  The QR-code thingy hits a friction barrier. For me needing to go to my phone is more friction than unlocking my password manager. Note that I only need to unlock my password manager once per reboot, and that for most people the password manager is already too much friction.
  - BillinghamJ 8y ago
    You'd only use the QR code thing if you were logging into an app on your phone, but had opened the email on your laptop. It wouldn't make sense in the other direction.
- AgentME 8y ago
  Does this work for the case you have your email on your phone but you want to use the site on a computer? That seems more likely to me than the case that you have your email on your computer only, but it is neat to see that case addressed.
  - BillinghamJ 8y ago
    Yeah it's a fair point. The case I mentioned is for Cuvva, which currently is mobile-only. Webmail is always a decent backup option though, so doesn't give me too much concern in terms of people getting stuck. But may be a little less seamless, particularly if they're using a shared/public computer. That scenario throws password managers out of the window too though.
rocqua 8y ago
> one of them is security scanning software potentially visiting the link. I gave it some thought, and that seems to be solvable. Have the link go to a 'confirm' page, where the confirm button performs a post request. If security scanning software is randomly hitting post requests, that is just totally ridiculous. What seems a lot more scary to me is the plaintext nature of e-mail. Even SMTP over TLS doesn't keep any end-points from reading your email, and I'm guessing there is a small but significant set of people who'se email providers don't run TLS. Besides, if someone can recognize that any request is underway for a login, they might intercept it and send a phishing fake.

by ryan-c 8y ago

comma-ampersand 8y ago

You might as well email them the letters.

BillinghamJ 8y ago

They are trivially solvable problems. PKCE and just displaying a QR code if you open it on the wrong device makes it pretty much foolproof. e.g.: https://magic.cuvva.com/auth-callback?code=authzcode_000000BUbZIHZJMzS8f4NLD7tmltY.fa5e2579d6693016765cf04d2c69b3a58785352591244b69c0e04f3c0e5411ce&state=Ijn8I4qQr6HqfG0kxh05rsLmF4IqB3JNchgpbSRR7HY https://magic.cuvva.com/auth-callback?code=authzcode_000000B... We're oriented around mobile use cases. Admittedly less ideal if you don't have your email on your desktop. But ultimately, if all else fails, you can always log into your webmail. For me the key thing is that it doesn't rely on users having any particular knowledge or understanding best practices - they just need to hit the big green button. Sure people are more used to passwords, but that doesn't mean the usability of magic links isn't still better despite them being much less common. Normal people are so bad at dealing with passwords. They reuse them, they forget them, they write them down on text files on their computer. Almost anything is better if your userbase isn't primarily technically adept people. And frankly most popular email providers are pretty good at keeping the accounts secure. Likely much better than anything homegrown we could do. Especially given the fact that you'll just end up having password resets via email anyway.

Lukas_Skywalker 8y ago
> They reuse them, they forget them, they write them down on text files on their computer. Writing them down in a textfile on the computer might not even be that bad _if_ they, as a consequence, are not or less reused.
rocqua 8y ago
The QR-code thingy hits a friction barrier. For me needing to go to my phone is more friction than unlocking my password manager. Note that I only need to unlock my password manager once per reboot, and that for most people the password manager is already too much friction.
- BillinghamJ 8y ago
  You'd only use the QR code thing if you were logging into an app on your phone, but had opened the email on your laptop. It wouldn't make sense in the other direction.
AgentME 8y ago
Does this work for the case you have your email on your phone but you want to use the site on a computer? That seems more likely to me than the case that you have your email on your computer only, but it is neat to see that case addressed.
- BillinghamJ 8y ago
  Yeah it's a fair point. The case I mentioned is for Cuvva, which currently is mobile-only. Webmail is always a decent backup option though, so doesn't give me too much concern in terms of people getting stuck. But may be a little less seamless, particularly if they're using a shared/public computer. That scenario throws password managers out of the window too though.

rocqua 8y ago

> one of them is security scanning software potentially visiting the link. I gave it some thought, and that seems to be solvable. Have the link go to a 'confirm' page, where the confirm button performs a post request. If security scanning software is randomly hitting post requests, that is just totally ridiculous. What seems a lot more scary to me is the plaintext nature of e-mail. Even SMTP over TLS doesn't keep any end-points from reading your email, and I'm guessing there is a small but significant set of people who'se email providers don't run TLS. Besides, if someone can recognize that any request is underway for a login, they might intercept it and send a phishing fake.