5 ms·
Oh, this is so terrible. I hate this approach with a passion. E-mail is NOT INSTANTANEOUS. It was never meant to be. It happens to arrive quickly for most peop
by jwr 6y ago
Oh, this is so terrible. I hate this approach with a passion.
E-mail is NOT INSTANTANEOUS. It was never meant to be. It happens to arrive quickly for most people most of the time, but you should never, ever, base a service on that.
Many systems have greylisting in place: a new sender gets a 4xx reply, and is allowed through only on subsequent retries after a pre-set time period. This is often as much as 30-60 minutes. It's a good approach to reduce spam, it turns out a lot of spamming software does not bother to retry, or doesn't want to incur the cost.
So, if you try this OTP-over-Email approach, you end up with frustrated customers, who 1) have to wait up to 60 minutes, 2) their OTP doesn't work, because you expired it after 5 minutes.
It's terrible. Don't do it.
- progval 6y agoAs a user, I have the same issue but in the opposite direction. My greylisting config requires only 1 minute wait, but many providers only retry after 5-10 minutes. Usually I can request a new login (or email verification) link and it will go through immediately. It does not work with Sendgrid-based services though, as Sendgrid rotates the IP used by the service for every mail.
- wruza 6y agoWhy can all instant messengers do this “instant” part and email cannot? I’m aware of mta chains, decentralization, etc, but heck.
- Someone 6y agoBecause, as jwr says, it was never meant to be. The mental model is that of regular mail that gets collected at post offices, then split by major destination, sent on, and finally ends up in a mailbox. Mail servers do not even have to be on the internet (https://en.wikipedia.org/wiki/Non-Internet_email_address https://en.wikipedia.org/wiki/Non-Internet_email_address), or on a network at all. It was fairly normal to have a time sharing system dial in to a mail server every day for a few minutes to exchange mail messages (https://en.wikipedia.org/wiki/UUCP#Mail_routing https://en.wikipedia.org/wiki/UUCP#Mail_routing)) Also, of course, it is harder to accomplish in a decentralized system that isn’t controlled by a single party.
- jwr 6y agoExcellent points. As someone who has carried UUCP mail on floppies to computers not connected to the network at all, I can relate :-)
- jiofih 6y agoEmail has been nearly instantaneous for me for the past decade or so. Either it arrives in a 30 second window, or never. Usually 2-5 seconds.
- Macha 6y agoI have both a personal G Suite domain (formerly "Google Apps For Your Domain") and my employer's G Suite account where in both cases I've experienced 5+ minute delays on a semi-frequent basis.
- samb1729 6y ago> (formerly "Google Apps For Your Domain") And now formerly G Suite, as it's become Google Workspace. Gotta keep that "products rebranded per decade" quota up, it seems!
- Izkata 6y agoOur work email is gmail-hosted, and just once a few weeks ago, I received an internal email days after it was sent.
- bryanrasmussen 6y agoemail is supposed to be dependable - as a protocol - it should always arrive. This dependability comes at the price that in some edge cases it must arrive slowly. There should be no 'never' arrive, although I realize that many services now effectively keep email from actually being seen by the user in the name of combating the various problems a free, anonymous, dependable message delivery protocol inevitably give rise to.
- sethammons 6y agoI run an MTA sending billions of emails daily. Most mail is delivered in seconds, but there is a long tail that can take days (myriad of reasons involving recipient mail servers, dns, sending behavior , etc). It would not be fun to have your log in attempt come in a couple days later. 99.9%+ you will be just fine, but how do you handle those people who fall through into long-delay land?
- 6y ago
- snarf21 6y agoRight, it isn't authentication, it is only account control. If you have to login to your email anyway. We just need simpler 2FA options. FIDO is moving the ball forward in the right direction but they don't seem willing to push the final steps.
- riedel 6y agoFunny that SMS second factor auth took off. I remember that the sometimes hour long delays in SMS . I actual was astonished by the simplicity of sign in links when for the first time using gather.town . I have seen then also in banking (revolute) with IP address pinning which proved to be annoying because this randomly switched depending on network availability.
- colesantiago 6y ago> ...because you expired it after 5 minutes. Just increase the time? 30 mins will do. Especially if it's only one time use.