3 ms·

Most of his issues with magic links don't exist everywhere. Maybe "Notion's" magic links are bad, but not everyone does that. They're not tedious if you persis

by nickjj 8y ago

Most of his issues with magic links don't exist everywhere. Maybe "Notion's" magic links are bad, but not everyone does that. They're not tedious if you persist the login beyond 1 session. There's also no need for any type of codes. You just receive the email, open it, click the link and then you could be potentially logged in for months or longer (it's up to the site who issues the link). It's one of the easiest and fastest flows you can ask for with technology that works today in all major browsers.

k_bx 8y ago
> You just receive the email, open it, click the link and then you could be potentially logged in for months One caveat is that your ios gmail app opens an internal browser, that has distinct cookies from main one. So there needs to be some clever websocket listener on the "main" browser that would receive a signal that a person signed in. That said, the product I'm building needs users to log in rarely and painlessly, I decided to do: 1. use simple magic code (no magic link, also "please fill your full account info" once logged in, eliminates separate registration) 2. use "sign-in via ..."
amdelamar 8y ago
Magic link emails are terribly slooooow. Waiting for that email takes too long most of the time. I could've already logged in with a password by now, not even using a password manager.
- nickjj 8y ago
  > Magic link emails are terribly slooooow. Waiting for that email takes too long most of the time. I could've already logged in with a password by now, not even using a password manager. That depends on how it's implemented. It's up to the site owner to dictate the behavior. You can have them login the first time without an email link click and let them know they need to confirm their email after closing this session in order to access the site. This way you can use the site immediately. That is no less secure than most password based sign ups that have no email confirmation.
seanwilson 8y ago
How long should the link work for though? What are the security implications? Also, you get cases where someone has email checking set up on their phone but not the machine they're on so clicking the magic link isn't ideal. This can be helped by supplying a code in the email you can type into the site though. As a side note, how do developers working on systems that need magic links deal with them while developing? Usually you need some way to bypass the email checking part while you develop.
- nickjj 8y ago
  > How long should the link work for though? Up to you. An hour or 2 seems ok as a general rule. > Also, you get cases where someone has email checking set up on their phone but not the machine they're on so clicking the magic link isn't ideal. Does that really come up? I've never experienced this. If I'm signing up for something on my desktop workstation, it is always capable of retrieving email. A lot of password confirmation links (as an alternative to magic links) would also expect you to click a link to verify your account, which means you would have to do it on the same machine you signed up with. > As a side note, how do developers working on systems that need magic links deal with them while developing? Usually you need some way to bypass the email checking part while you develop. Couple of options. Bypassing it is a valid choice. Also if your framework supports it, you can often configure things in development so that emails aren't really sent, but you're given a URL that you can visit which opens a web based inbox page. This way you can preview your emails and click links. It's basically an in-memory no-op local mail server for receiving email. Rails and Phoenix do this well.
  - seanwilson 8y ago
    > Up to you. An hour or 2 seems ok as a general rule. Oh, I meant how long after you click the link should you stay logged in for? My bank makes me reenter my password after maybe 1 hour of inactivity for example which would be super annoying with magic links. > Does that really come up? I've never experienced this. If I'm signing up for something on my desktop workstation, it is always capable of retrieving email. A lot of password confirmation links (as an alternative to magic links) would also expect you to click a link to verify your account, which means you would have to do it on the same machine you signed up with. I haven't used magic links enough to be honest but when I sign up using dev/test email addresses I don't often check, the hassle to get the email is annoying. I guess that's true for account verification emails as well though, which is a good point.

by nickjj 8y ago

k_bx 8y ago

> You just receive the email, open it, click the link and then you could be potentially logged in for months One caveat is that your ios gmail app opens an internal browser, that has distinct cookies from main one. So there needs to be some clever websocket listener on the "main" browser that would receive a signal that a person signed in. That said, the product I'm building needs users to log in rarely and painlessly, I decided to do: 1. use simple magic code (no magic link, also "please fill your full account info" once logged in, eliminates separate registration) 2. use "sign-in via ..."

amdelamar 8y ago

Magic link emails are terribly slooooow. Waiting for that email takes too long most of the time. I could've already logged in with a password by now, not even using a password manager.

nickjj 8y ago
> Magic link emails are terribly slooooow. Waiting for that email takes too long most of the time. I could've already logged in with a password by now, not even using a password manager. That depends on how it's implemented. It's up to the site owner to dictate the behavior. You can have them login the first time without an email link click and let them know they need to confirm their email after closing this session in order to access the site. This way you can use the site immediately. That is no less secure than most password based sign ups that have no email confirmation.

seanwilson 8y ago

How long should the link work for though? What are the security implications? Also, you get cases where someone has email checking set up on their phone but not the machine they're on so clicking the magic link isn't ideal. This can be helped by supplying a code in the email you can type into the site though. As a side note, how do developers working on systems that need magic links deal with them while developing? Usually you need some way to bypass the email checking part while you develop.

nickjj 8y ago
> How long should the link work for though? Up to you. An hour or 2 seems ok as a general rule. > Also, you get cases where someone has email checking set up on their phone but not the machine they're on so clicking the magic link isn't ideal. Does that really come up? I've never experienced this. If I'm signing up for something on my desktop workstation, it is always capable of retrieving email. A lot of password confirmation links (as an alternative to magic links) would also expect you to click a link to verify your account, which means you would have to do it on the same machine you signed up with. > As a side note, how do developers working on systems that need magic links deal with them while developing? Usually you need some way to bypass the email checking part while you develop. Couple of options. Bypassing it is a valid choice. Also if your framework supports it, you can often configure things in development so that emails aren't really sent, but you're given a URL that you can visit which opens a web based inbox page. This way you can preview your emails and click links. It's basically an in-memory no-op local mail server for receiving email. Rails and Phoenix do this well.
- seanwilson 8y ago
  > Up to you. An hour or 2 seems ok as a general rule. Oh, I meant how long after you click the link should you stay logged in for? My bank makes me reenter my password after maybe 1 hour of inactivity for example which would be super annoying with magic links. > Does that really come up? I've never experienced this. If I'm signing up for something on my desktop workstation, it is always capable of retrieving email. A lot of password confirmation links (as an alternative to magic links) would also expect you to click a link to verify your account, which means you would have to do it on the same machine you signed up with. I haven't used magic links enough to be honest but when I sign up using dev/test email addresses I don't often check, the hassle to get the email is annoying. I guess that's true for account verification emails as well though, which is a good point.