4 ms·

I love this idea. 90% of the time when I use a forgot password link, I'm really trying to auth-by-email. I'm not sure how it would work for reusable links, sinc

by Cushman 15y ago

I love this idea. 90% of the time when I use a forgot password link, I'm really trying to auth-by-email. I'm not sure how it would work for reusable links, since that becomes auth-by-URL, which seems significantly less secure— maybe putting HTTP auth in the url would be less likely to be logged at any point?

makmanalp 15y ago
Isn't this basically the same thing as e-mailing yourself your password?
- woodall 15y ago
  Not if the link can time-out or expire after X [days, minutes, seconds, ect]. When I think of emailing my self the password, I think of storing it in plain text in my email account. When I think of authentication via email I think of a one time use link that allows me to log into a session.
  - repsilat 15y ago
    Email is sent in plaintext. It'd be easy enough for an attacker to request an email authentication (which it then sniffs in transit). Expiry time doesn't help much. Email auth really should be done as Joakal says - your public key stored on their server when you sign up, email auth is encrypted. Trouble is, it's "too hard" for "normal people". If gmail/outlook etc supported it, though, it could catch on.
    - Cushman 15y ago
      We're starting out from the position that my email is the keys to my digital castle... good or bad as that may be, if someone can reliably sniff my email in transit they already own my life.
- Cushman 15y ago
  In the same way that forgot password links are. The key difference is that the token expires on its own.
Joakal 15y ago
Auth emails are like plaintext passwords. Best combo would be your public key stored on their server. Any future requests, they send you the PGP'd email.
Johngibb 15y ago
wouldn't oauth (by gmail perhaps?) be a better solution to this?
- Cushman 15y ago
  It is oauth for all intents and purposes— a third party (your email server) authenticates you as the owner of the email address and passes you a secure token. It's worse in some ways (control, usability, security) and better in others (simpler technologically, everyone has it).

by Cushman 15y ago

makmanalp 15y ago

Isn't this basically the same thing as e-mailing yourself your password?

woodall 15y ago
Not if the link can time-out or expire after X [days, minutes, seconds, ect]. When I think of emailing my self the password, I think of storing it in plain text in my email account. When I think of authentication via email I think of a one time use link that allows me to log into a session.
- repsilat 15y ago
  Email is sent in plaintext. It'd be easy enough for an attacker to request an email authentication (which it then sniffs in transit). Expiry time doesn't help much. Email auth really should be done as Joakal says - your public key stored on their server when you sign up, email auth is encrypted. Trouble is, it's "too hard" for "normal people". If gmail/outlook etc supported it, though, it could catch on.
  - Cushman 15y ago
    We're starting out from the position that my email is the keys to my digital castle... good or bad as that may be, if someone can reliably sniff my email in transit they already own my life.
Cushman 15y ago
In the same way that forgot password links are. The key difference is that the token expires on its own.

Joakal 15y ago

Auth emails are like plaintext passwords. Best combo would be your public key stored on their server. Any future requests, they send you the PGP'd email.

Johngibb 15y ago

wouldn't oauth (by gmail perhaps?) be a better solution to this?

Cushman 15y ago
It is oauth for all intents and purposes— a third party (your email server) authenticates you as the owner of the email address and passes you a secure token. It's worse in some ways (control, usability, security) and better in others (simpler technologically, everyone has it).