8 ms·

We have tried this for a while and the following reasons made us kill it: 1. Email delivery latency: depending on the service you use, the time it takes to del

We have tried this for a while and the following reasons made us kill it: 1. Email delivery latency: depending on the service you use, the time it takes to deliver emails to the user can vary. Worst case I encountered was up to 20 minutes delay when there were issues with Mailgun. 2. Usability: you have to leave your current app and switch to your mail client. You may be on a device where you don't have a mail client installed at all, so you have to provide a password login option as well. 3. The sign in dialog gets more complicated and it's hard to explain to users how it works as it is not all that common. This also had effects on sign up/sign in dialog design which we found to have a negative impact on conversion rates.

innocenat 6y ago
I resonate deeply with this comment. As an extension to your second point, sometimes I want to login to a service on a shared/public computer out of necessity. I'd really not want to login into my email on said computer too.
- Nemo157 6y ago
  A good one-time-sign-in-link implementation will send a link to authenticate a session elsewhere, so you can click the link on your phone to complete login on the computer.
  - szszrk 6y ago
    That's kind off what Microsoft does in Microsoft Authenticator. It doesn't ask for password, it sends notification to you phone app and asks you to tap "65". The app then shows 3 numbers, one is 65. You log in on the other device after tapping. No passwords entered at all. They did a nice job on that one.
  - sam_lowry_ 6y ago
    What if we just allowed sending one-time links not only via mail, but via Telegram, Whatsapp, Messenger, Signal and a bunch of other options?
  - cesarb 6y ago
    That assumes the user can click the link on the phone. The reason a user might be "using a shared/public computer out of necessity" might be because the user does not at that moment have working Internet on the phone. For instance, the user might be outside the home area without a roaming agreement, or the user might be out of prepaid credits on the phone.
  - arminiusreturns 6y ago
    As a counterpoint to this, I quite dislike this approach, especially when the auth is a link instead of a OT2P, because now whatever I am accessing has metadata and can cross-correlate data from other providers about my phone. Amazon is one in particular that I experience, and I never click the link, and rather just type it out by hand on the system I am already trying to log in via.
  - gfodor 6y ago
    We did this for Mozilla Hubs (hubs.mozilla.com) specifically so people can easily sign in from within a VR headset which doesn't have a password manager and which is hard to type in. However, the problem is that this goes so much against user expectations it just confuses people and they end up going through the grueling version of typing the long link in by hand in VR since they can't imagine it could be as easy as opening it on their phone. (We of course, call this out in the prompt, but nobody reads that.)
- cuu508 6y ago
  I just assume my every keypress on a public/shared PC gets keylogged, so a password is not a great option either.
camhart 6y ago
4. Email delivery period. Using AWS Simple Email Service, you're actually sharing an email server IP address with other accounts. At times those accounts can get the IP address added to spam lists. All the sudden your emails stop getting received on some clients.* * Solution to this is to pay $$ / month to get a dedicated IP address, then never let it get added to a spam list.
- starbugs 6y ago
  We ended up purchasing a dedicated IP from Mailgun. This solves the spam/latency problem mostly, but brings about new problems.
  - albertgoeswoof 6y ago
    What other problems do you face with a dedicated IP?
    - starbugs 6y ago
      You have more management work for your team. If something's wrong with it, it's mostly your problem. I initially thought it was a "problem solved" thing by paying the money. Ended up causing us regular work (not much, but still).
    - petercooper 6y ago
      Not MailGun, but we have 3 dedicated IPs with SendGrid and one problem is that there are spamlists and ISPs that block or mark down IP blocks owned by SendGrid so you get no real advantage from the dedicated IP. I wish you could "bring your own IP" to these services.
      - jethro_tell 6y ago
        Heh, it would get tagged as a sendgrid ip after a few transactions.
- albertgoeswoof 6y ago
ss64 6y ago
20 minutes delay! Ha my worst is about 10 days.
- starbugs 6y ago
  I guess we got lucky then? It doesn't seem to make a big difference though. After a couple of minutes most users considered the login attempt failed in our cases.
wruza 6y ago
>sign up/sign in Why were clear terms like login/register/logout replaced with a “sign ...”? I get confused twice a week by these, especially because the difference between “in” and “up” is so subtle (and overloaded, like “sign up for a meeting at friday”, unrelated to registration routine). Sorry for offtopic, but it is really annoying. Is it more linguistically correct or just a hipster thing?
- samb1729 6y ago
  I'm not sure they were ever replaced; the terms co-exist. I believe the terms all stem from the general concept of writing a name on a piece of paper. To "register" your interest in an something, you might sign a piece of paper, or instruct a person to "sign [you] up". To show that you entered a physical event, you would sign an entry log on a piece of paper, then having "logged in" or "signed in", and then do the opposite on your way out. Similarly you might refer to reproducing your physical signature as having "authenticated" yourself, if there's something to compare it to. What makes one particular set of terms the right set given the apparent origins?
- gjvnq 6y ago
  I usually prefer the terms "sign up" and "log in" as they are different enough to avoid confusion.
- codingclaws 6y ago
  I researched this several years ago and for various reasons it's best to use: sign up, log in, and log out.
  - appleflaxen 6y ago
    can you elaborate on the basis for this? it sounds interesting, but the rationale isn't obvious.
- jjoonathan 6y ago
  > "sign ..." Sometimes literally that, with an ellipsis hiding the part that would otherwise distinguish between alternatives, so you just have to click and guess.
krageon 6y ago
From a user standpoint the delivery latency is really what kills it for me. I use one or two websites that still have one-time sign in links and it's always a tossup whether or not I can actually get in within a few minutes. If the email arrives an hour later I've moved on with my life and I can't imagine it is any different for other people.
- ketamine__ 6y ago
  I've experienced that too.
  - krageon 6y ago
    Then you haven't used it for very long. Besides that, more exists than some tech giant's gambit to gather and exploit as much user information as they can. Nobody should use gmail, unless they are forced to by their job (in which case they should try to change it if they are in a position to).
    - deleted 6y ago
      [deleted]
    - AlchemistCamp 6y ago
      What email service do you recommend?
      - krageon 6y ago
        Any one in a privacy-friendly location. There's a ton of German providers (posteo, tutanota, mailbox.org, etc) which are always safe choices. Emphatically not Protonmail, as it makes promises it doesn't deliver on and has a very strange architecture for it's security besides.
  - jacoblambda 6y ago
    The issue isn't with the user's email. The issue is with the site's email provider. If the email server sending out the one time links is under heavy load or for some reason has a backlog, it may take a while for the links to actually get to the user. This usually happens because whatever service the site is using to handle sending out emails is under heavy load, having issues, or is rate limiting the site due to a sudden spike in logins. If this happens for any reason, it failure cascades because the more people try to log in, the longer it will take for everyone to get a valid link. At least with a standard TOTP token or the like, if the service is under load it will eventually work if you keep trying (versus not working for longer the more people try). Hell this method also runs into the issue of getting flagged as spam or getting blacklisted due to ~~the algorithm~~ for one reason or another. This is doubly likely if a sudden burst of traffic to a site results in them sending out a mass wave of near identical emails. Now non-tech users can't log in at all since they "never get the email at all". Email is a wonderful thing but it is painfully fragile and doesn't handle time sensitive stuff well at scale (due to queuing, routing issues, and spam filters).
jeswin 6y ago
4. Gmail (atleast on Android) will try to open the link in a sort of Webview, which is never ideal. All the browser options are gone, plus I don't need to trust Gmail with the ability to read screen contents.
- p49k 6y ago
  This is exactly the reason why I hate sites that use one-time email sign-in links. The link opens in Webview, then you have to click a separate button to reopen the page in Safari, but by that time the token is marked as used, so you can't login except in this temporary window that is going to immediately disappear the second you perform any other action.
skohan 6y ago
regarding point 3, I feel like familiarity bias is such a difficult thing to overcome sometimes with UX. However poor the experience of the standard signup/auth process is, users have already learned the complexity, and the risk is super high when you're showing people a totally new type of hurdle they have to jump to access your product. Even if it's less complex objectively, if they fail the first time there's a high chance that user is never coming back. But I think authentication in general is a problem which really needs to be solved, and in a standards-based way. For instance, with connecting to public wifi networks (i.e. at an airport), it's absurd to have to go through a web page every time to log in. Also with the proliferation of IoT devices, it's always painful to go through the process of connecting it to my bluetooth and/or wifi. There should be some kind way to handle trust systematically through my smartphone without having to manually type a bunch of passwords.
codethief 6y ago
If I may add: 4. Some email clients still break links in emails 5. Proper links require HTML; otherwise you rely on the email client recognizing a URL as such (which brings us back to 4). 6. The email might mistakenly get recognized as spam.
codethief 6y ago
> 1. Email delivery latency This is particularly true when the recipient has enabled Greylisting[0] and delivery has to be attempted multiple times (which is perfectly fine from the point of view of the RFC standards). In view of this, email delivery rather resembles real-world postal package delivery (and not so much the instantaneous delivery of, say, phone calls). [0] https://en.wikipedia.org/wiki/Greylisting_(email) https://en.wikipedia.org/wiki/Greylisting_(email)
- ytch 6y ago
  Is it possible to solve by some kinds of warming up? AFAIK greylist is IP-based. We can send email at regular time so all the sender IP can keep in list. But email does has many uncertainty like spam detection and others to slow the process after SMTP server receive it.
  - jethro_tell 6y ago
    How would that work? Send an email to every customer (domain, so pick a single customer at every domain) and send them an email with a fake login, or a note that says please disregard? Aside from that being spam, it's also likely to get legit emails stuck in spam filters as people start marking them as spam. Secondly, I think most of the largest providers don't really grey list any longer. They seem to have moved to inbound throttling. So your first email goes through but then if you send a rash of mail, you end up seeing the throttle on the back side.
    - ytch 6y ago
      > Send an email to every customer (domain, so pick a single customer at every domain) Greylist is allow/block based on sender IP, not receiving metadata, so I guess pre-send mail from the IP might help, but yes, other rules might slow down.
      - jethro_tell 6y ago
        It's not just connect based, you have to connect and send an email. Which would be spam. Most systems I've worked on score based on how much your server looks like it's doing its job and moving on. Long connection with inactivity get tagged, scored and disconnected. Connecting without sending an email leaves you in the grey list queue. There is to my knowledge not a great way to pre-warm for grey-listing
swiley 6y ago
One more issue is if you're using eg microsofts webmail (office? hotmail? I'm not sure what it's called but my university had it) the links will get queried automatically to "scan them for viruses" which tends to expire them.
- fredcy 6y ago
  We ran into this, where the Outlook client would scan one-time login links from SalesForce (iirc). Huge pain to work around.
  - fomine3 6y ago
    It's bad but I also argue that generally GET should not change state. It seems that weirdly email is the only place that allowed GET URL to change state (like unsubscribe link).
- ngrilly 6y ago
  I ran exactly into this problem with linear.app (which uses passwordless login with "magic" links) and Outlook / Office 365. Only solution has been to ask linear.app to disable the links for our account and keep only the one-time code that we manually copy-paste.
justusthane 6y ago
Yeah. In theory it’s a neat idea—in practice I hate it. There’s one service that I literally can’t log in to because the link has always expired by the time I receive it.
roseway4 6y ago
(1) is tractable. A number of email sending providers offer SLAs around delivery latency. Some also provide significant deliverability resources to help senders mitigate the risk of spam foldering. Source: I work for SparkPost and we do all of the above.
jjeaff 6y ago
And don't forget the security implication that someone with access to your email can log in to your account undetected. With traditional password reset by email, at least when I try to login next, my password won't work and I'll know something might be up and can change my email password.
nwienert 6y ago
One more: Gmail app on iPhone forces you to open links within the app, meaning you can’t actually login with Safari proper (the session/cookies aren’t shared). Super frustrating, and something Apple should clamp down on (any app that opens web links needs to provide a full “open in Safari” option that isn’t an in-app browser).
the_arun 6y ago
I like the implementation of https://www.fast.co/ https://www.fast.co/. 1. There is a dependency on speed of email delivery. May be use SMS as well? 2. Personally, I didn't find it too difficult. We run into same issue if we have MFA 3. fast.co experience is pretty clean. Give it a try Disclaimer: I am not affiliated with fast.co
wdb 6y ago
My main problem with it they seem to assume that you have an email client on the device you want to access the site. I don't have mail account setup on my iPad so I need to mess around with AirDrop or iCloud to share the code.

innocenat 6y ago

I resonate deeply with this comment. As an extension to your second point, sometimes I want to login to a service on a shared/public computer out of necessity. I'd really not want to login into my email on said computer too.

Nemo157 6y ago
A good one-time-sign-in-link implementation will send a link to authenticate a session elsewhere, so you can click the link on your phone to complete login on the computer.
- szszrk 6y ago
  That's kind off what Microsoft does in Microsoft Authenticator. It doesn't ask for password, it sends notification to you phone app and asks you to tap "65". The app then shows 3 numbers, one is 65. You log in on the other device after tapping. No passwords entered at all. They did a nice job on that one.
- sam_lowry_ 6y ago
  What if we just allowed sending one-time links not only via mail, but via Telegram, Whatsapp, Messenger, Signal and a bunch of other options?
- cesarb 6y ago
  That assumes the user can click the link on the phone. The reason a user might be "using a shared/public computer out of necessity" might be because the user does not at that moment have working Internet on the phone. For instance, the user might be outside the home area without a roaming agreement, or the user might be out of prepaid credits on the phone.
- arminiusreturns 6y ago
  As a counterpoint to this, I quite dislike this approach, especially when the auth is a link instead of a OT2P, because now whatever I am accessing has metadata and can cross-correlate data from other providers about my phone. Amazon is one in particular that I experience, and I never click the link, and rather just type it out by hand on the system I am already trying to log in via.
- gfodor 6y ago
  We did this for Mozilla Hubs (hubs.mozilla.com) specifically so people can easily sign in from within a VR headset which doesn't have a password manager and which is hard to type in. However, the problem is that this goes so much against user expectations it just confuses people and they end up going through the grueling version of typing the long link in by hand in VR since they can't imagine it could be as easy as opening it on their phone. (We of course, call this out in the prompt, but nobody reads that.)
cuu508 6y ago
I just assume my every keypress on a public/shared PC gets keylogged, so a password is not a great option either.

camhart 6y ago

4. Email delivery period. Using AWS Simple Email Service, you're actually sharing an email server IP address with other accounts. At times those accounts can get the IP address added to spam lists. All the sudden your emails stop getting received on some clients.* * Solution to this is to pay $$ / month to get a dedicated IP address, then never let it get added to a spam list.

starbugs 6y ago
We ended up purchasing a dedicated IP from Mailgun. This solves the spam/latency problem mostly, but brings about new problems.
- albertgoeswoof 6y ago
  What other problems do you face with a dedicated IP?
  - starbugs 6y ago
    You have more management work for your team. If something's wrong with it, it's mostly your problem. I initially thought it was a "problem solved" thing by paying the money. Ended up causing us regular work (not much, but still).
  - petercooper 6y ago
    Not MailGun, but we have 3 dedicated IPs with SendGrid and one problem is that there are spamlists and ISPs that block or mark down IP blocks owned by SendGrid so you get no real advantage from the dedicated IP. I wish you could "bring your own IP" to these services.
    - jethro_tell 6y ago
      Heh, it would get tagged as a sendgrid ip after a few transactions.
albertgoeswoof 6y ago

ss64 6y ago

20 minutes delay! Ha my worst is about 10 days.

starbugs 6y ago
I guess we got lucky then? It doesn't seem to make a big difference though. After a couple of minutes most users considered the login attempt failed in our cases.

wruza 6y ago

>sign up/sign in Why were clear terms like login/register/logout replaced with a “sign ...”? I get confused twice a week by these, especially because the difference between “in” and “up” is so subtle (and overloaded, like “sign up for a meeting at friday”, unrelated to registration routine). Sorry for offtopic, but it is really annoying. Is it more linguistically correct or just a hipster thing?

samb1729 6y ago
I'm not sure they were ever replaced; the terms co-exist. I believe the terms all stem from the general concept of writing a name on a piece of paper. To "register" your interest in an something, you might sign a piece of paper, or instruct a person to "sign [you] up". To show that you entered a physical event, you would sign an entry log on a piece of paper, then having "logged in" or "signed in", and then do the opposite on your way out. Similarly you might refer to reproducing your physical signature as having "authenticated" yourself, if there's something to compare it to. What makes one particular set of terms the right set given the apparent origins?
gjvnq 6y ago
I usually prefer the terms "sign up" and "log in" as they are different enough to avoid confusion.
codingclaws 6y ago
I researched this several years ago and for various reasons it's best to use: sign up, log in, and log out.
- appleflaxen 6y ago
  can you elaborate on the basis for this? it sounds interesting, but the rationale isn't obvious.
jjoonathan 6y ago
> "sign ..." Sometimes literally that, with an ellipsis hiding the part that would otherwise distinguish between alternatives, so you just have to click and guess.

krageon 6y ago

From a user standpoint the delivery latency is really what kills it for me. I use one or two websites that still have one-time sign in links and it's always a tossup whether or not I can actually get in within a few minutes. If the email arrives an hour later I've moved on with my life and I can't imagine it is any different for other people.

ketamine__ 6y ago
I've experienced that too.
- krageon 6y ago
  Then you haven't used it for very long. Besides that, more exists than some tech giant's gambit to gather and exploit as much user information as they can. Nobody should use gmail, unless they are forced to by their job (in which case they should try to change it if they are in a position to).
  - deleted 6y ago
    [deleted]
  - AlchemistCamp 6y ago
    What email service do you recommend?
    - krageon 6y ago
      Any one in a privacy-friendly location. There's a ton of German providers (posteo, tutanota, mailbox.org, etc) which are always safe choices. Emphatically not Protonmail, as it makes promises it doesn't deliver on and has a very strange architecture for it's security besides.
- jacoblambda 6y ago
  The issue isn't with the user's email. The issue is with the site's email provider. If the email server sending out the one time links is under heavy load or for some reason has a backlog, it may take a while for the links to actually get to the user. This usually happens because whatever service the site is using to handle sending out emails is under heavy load, having issues, or is rate limiting the site due to a sudden spike in logins. If this happens for any reason, it failure cascades because the more people try to log in, the longer it will take for everyone to get a valid link. At least with a standard TOTP token or the like, if the service is under load it will eventually work if you keep trying (versus not working for longer the more people try). Hell this method also runs into the issue of getting flagged as spam or getting blacklisted due to ~~the algorithm~~ for one reason or another. This is doubly likely if a sudden burst of traffic to a site results in them sending out a mass wave of near identical emails. Now non-tech users can't log in at all since they "never get the email at all". Email is a wonderful thing but it is painfully fragile and doesn't handle time sensitive stuff well at scale (due to queuing, routing issues, and spam filters).

jeswin 6y ago

4. Gmail (atleast on Android) will try to open the link in a sort of Webview, which is never ideal. All the browser options are gone, plus I don't need to trust Gmail with the ability to read screen contents.

p49k 6y ago
This is exactly the reason why I hate sites that use one-time email sign-in links. The link opens in Webview, then you have to click a separate button to reopen the page in Safari, but by that time the token is marked as used, so you can't login except in this temporary window that is going to immediately disappear the second you perform any other action.

skohan 6y ago

regarding point 3, I feel like familiarity bias is such a difficult thing to overcome sometimes with UX. However poor the experience of the standard signup/auth process is, users have already learned the complexity, and the risk is super high when you're showing people a totally new type of hurdle they have to jump to access your product. Even if it's less complex objectively, if they fail the first time there's a high chance that user is never coming back. But I think authentication in general is a problem which really needs to be solved, and in a standards-based way. For instance, with connecting to public wifi networks (i.e. at an airport), it's absurd to have to go through a web page every time to log in. Also with the proliferation of IoT devices, it's always painful to go through the process of connecting it to my bluetooth and/or wifi. There should be some kind way to handle trust systematically through my smartphone without having to manually type a bunch of passwords.

codethief 6y ago

If I may add: 4. Some email clients still break links in emails 5. Proper links require HTML; otherwise you rely on the email client recognizing a URL as such (which brings us back to 4). 6. The email might mistakenly get recognized as spam.

codethief 6y ago

> 1. Email delivery latency This is particularly true when the recipient has enabled Greylisting[0] and delivery has to be attempted multiple times (which is perfectly fine from the point of view of the RFC standards). In view of this, email delivery rather resembles real-world postal package delivery (and not so much the instantaneous delivery of, say, phone calls). [0] https://en.wikipedia.org/wiki/Greylisting_(email) https://en.wikipedia.org/wiki/Greylisting_(email)

ytch 6y ago
Is it possible to solve by some kinds of warming up? AFAIK greylist is IP-based. We can send email at regular time so all the sender IP can keep in list. But email does has many uncertainty like spam detection and others to slow the process after SMTP server receive it.
- jethro_tell 6y ago
  How would that work? Send an email to every customer (domain, so pick a single customer at every domain) and send them an email with a fake login, or a note that says please disregard? Aside from that being spam, it's also likely to get legit emails stuck in spam filters as people start marking them as spam. Secondly, I think most of the largest providers don't really grey list any longer. They seem to have moved to inbound throttling. So your first email goes through but then if you send a rash of mail, you end up seeing the throttle on the back side.
  - ytch 6y ago
    > Send an email to every customer (domain, so pick a single customer at every domain) Greylist is allow/block based on sender IP, not receiving metadata, so I guess pre-send mail from the IP might help, but yes, other rules might slow down.
    - jethro_tell 6y ago
      It's not just connect based, you have to connect and send an email. Which would be spam. Most systems I've worked on score based on how much your server looks like it's doing its job and moving on. Long connection with inactivity get tagged, scored and disconnected. Connecting without sending an email leaves you in the grey list queue. There is to my knowledge not a great way to pre-warm for grey-listing

swiley 6y ago

One more issue is if you're using eg microsofts webmail (office? hotmail? I'm not sure what it's called but my university had it) the links will get queried automatically to "scan them for viruses" which tends to expire them.

fredcy 6y ago
We ran into this, where the Outlook client would scan one-time login links from SalesForce (iirc). Huge pain to work around.
- fomine3 6y ago
  It's bad but I also argue that generally GET should not change state. It seems that weirdly email is the only place that allowed GET URL to change state (like unsubscribe link).
ngrilly 6y ago
I ran exactly into this problem with linear.app (which uses passwordless login with "magic" links) and Outlook / Office 365. Only solution has been to ask linear.app to disable the links for our account and keep only the one-time code that we manually copy-paste.

justusthane 6y ago

Yeah. In theory it’s a neat idea—in practice I hate it. There’s one service that I literally can’t log in to because the link has always expired by the time I receive it.

roseway4 6y ago

(1) is tractable. A number of email sending providers offer SLAs around delivery latency. Some also provide significant deliverability resources to help senders mitigate the risk of spam foldering. Source: I work for SparkPost and we do all of the above.

jjeaff 6y ago

And don't forget the security implication that someone with access to your email can log in to your account undetected. With traditional password reset by email, at least when I try to login next, my password won't work and I'll know something might be up and can change my email password.

nwienert 6y ago

One more: Gmail app on iPhone forces you to open links within the app, meaning you can’t actually login with Safari proper (the session/cookies aren’t shared). Super frustrating, and something Apple should clamp down on (any app that opens web links needs to provide a full “open in Safari” option that isn’t an in-app browser).

the_arun 6y ago

I like the implementation of https://www.fast.co/ https://www.fast.co/. 1. There is a dependency on speed of email delivery. May be use SMS as well? 2. Personally, I didn't find it too difficult. We run into same issue if we have MFA 3. fast.co experience is pretty clean. Give it a try Disclaimer: I am not affiliated with fast.co

wdb 6y ago

My main problem with it they seem to assume that you have an email client on the device you want to access the site. I don't have mail account setup on my iPad so I need to mess around with AirDrop or iCloud to share the code.