12 ms·
Simple passwordless authentication for web projects
- jbaber 5y agoThe overview is the very last paragraph: > User creates an account with just their email or can create a temporary > account. Their session lasts for a long time. If it expires or they try to > login from a different browser, they get a code to their email. It’s a great > solution for a simple site that doesn’t get much traffic.
- throwoutway 5y agoMeta: The HackerNews submission correctly titles this as "authentication", but the blog post itself is incorrectly titled as "Simple Passwordless User Authorization"
- BeefWellington 5y agoPerhaps "delayed password authorization" is better than "passwordless" here since the magic code the user is getting via e-mail just becomes their (auto-rotating) password.
- fuckingWHY 5y ago
- sally1620 5y agoThis looks pretty secure to me. Most of the time, I just have to click forgot password and it is basically the same thing.
- tony-allan 5y agohttps://matthewc.dev/blog/projects/webdev/passwordless-auth/ https://matthewc.dev/blog/projects/webdev/passwordless-auth/
- matthewfcarlson 5y agoThanks for this, totally I forgot I submitted this and then started playing around with reorganizing my hugo content :)
- deleted 5y ago[deleted]
- pkulak 5y agoThe last project I did sends the important URL to the users email. It’s Craigslist-style auth and it works pretty well.
- chrisandchris 5y agoIt's convenient, yes. Unless you don't have mail setup on the machine you want to log in from. Then it's annoying at it's best...
- xdxfw 5y agoThis creates a dependency on the email. If your email gets compromised/locked, your account gets too. OTP passwords are better
- aaaaaaaaata 5y agoIs there any evidence that email accounts have done anything besides become stickier?
- withinboredom 5y agoSometimes, that’s exactly what you want though: you don’t care (and the user has bigger issues if their email is compromised) if the email is compromised. In the terms you might say “access is granted based on access to email that you register with” and if someone loses access to their email, you don’t need to do any id verification or “proof” to recover the account. You can just say “tough.”
- justsomehnguy 5y ago> OTP passwords are better For accounts which hold something of value (monetary and/or personal data) then sure. But every once in a while when I need to login to GitHub it blocks my logon and demand what I give it a code sent to my e-mail. In essence this doean't seems that different from the scheme in the article.
- cookiengineer 5y agoCredential stuffers will have a feast on this one.
- kim0 5y agoSounds pretty cool! Anyone libraries for this yet
- kevincox 5y agoI hate email-based authorization. It is an extra step and requires access to a working email. Sure 95% of the time I get that email in a second and then it is only a window switch, copy/click, delete and switch back (maybe paste). But 5% of the time it is even worse and the email gets marked spam, or greylisted for 15min. Password authentication is literally just clicking "Login" because my password-manager fills in the field. In this happy path it is also unphishable whereas the email-based example provided here is trivial to phish. The main problem with password login is the "bad" users who haven't bothered to set up a password manager or prefer to use their dog's name as their password on every site. It really sucks that a great workflow is being punished just because some users are irresponsible. Honestly I'm excited that we are getting 2FA pretty mainstream but honestly I think passwords are a going to be a good long-term solution. The main differences will be: 1. The browser will generate all your passwords. The UX to pick your own password will be awkward. 2. You won't give your password to the site (or server) but it will be exchanged via a PAKE.
- human 5y agoI also hate password emails. I use a password manager and find it much more efficient. However, I can see how this solution is interesting for small projects where users might create an account once and forget about it. I wouldn’t want that setup for a site I use often, and especially not for a site where I have multiple accounts (Twitter for example).
- slapslash 5y ago"Honestly I'm excited that we are getting 2FA pretty mainstream" Doesn't that have those extra steps included as well that you critizised on email-based auth?
- scim-knox-twox 5y agoNo, password managers can take care of that.
- umeshunni 5y ago
- eric4smith 5y agoI’ve been doing this for a while now with many projects. Essentially we have three ways to login: Google, Facebook and E-mail. In all cases it delegates authority to an external place that you’ve setup before. For the social networks we use the e-mail as the key. For e-mail we decided to just send a code instead of using a url. Since the pattern of checking your e-mail on your device while working on your desktop is quite common.
- cookiengineer 5y agoE-Mails are unencrypted and can be intercepted. When speaking of E-Mail as a user authentication method, it's just as unsecure as SMS. I'd heavily disrecommend the author's method of sending 2FA codes unencrypted through the internet. While it is an unlikely attack surface for private hackers, it is a very likely attack scenario of state level actors. Also: gpg as encryption isn't worth anything when everybody has your public key and/or sent it before via an unencrypted transport layer.
- Galanwe 5y ago> E-Mails are unencrypted and can be intercepted Hu, yes they are. I don't think there's still non ssl mail transport nowadays. > gpg as encryption isn't worth anything when everybody has your public key and/or sent it before via an unencrypted transport layer. Interesting how a grammatically correct English sentence can have 0 meaning.
- dane-pgp 5y ago> I don't think there's still non ssl mail transport nowadays. You might be off by 10%, unfortunately, but let's hope that 10% is just spam or other non-sensitive data. https://transparencyreport.google.com/safer-email/overview https://transparencyreport.google.com/safer-email/overview
- sriku 5y agoI use a similar technique to this author's on my site (for about 5 years now) but it is a variant where even if someone got the email or you forward it accidentally to someone, they won't be able to use it to login. Technique described here - http://sriku.org/blog/2017/04/29/forget-password/ http://sriku.org/blog/2017/04/29/forget-password/ ... basically when use provides email to signin, a cookie stores a part of the token while the server send the other part via email. Both parts need to be put together and validated for a login to get through. So the link sent in the email will work only in the browser session where the cookie stored at login time is accessible ... which is how it is configured for most of the users of my small site. Another side effect of this technique is that bad login attempts do not need a database hit to be rejected.
- Steele69 5y ago
- stavros 5y agoI wrote a Django library to do this easily: https://github.com/skorokithakis/django-tokenauth https://github.com/skorokithakis/django-tokenauth It's the easiest login method by far to deploy, though I think users seem to slightly dislike it.
- Toine 5y agoJuste use Firebase/Auth0/anything else. What a I missing ?
- mariusor 5y agoGenerally speaking the 'just use X' reply, where X is a technology with more friction than whatever it's meant to replace it's a sure sign of not understanding the problem. In this case it's right in the title: "Simple". Setting up connectivity to third party services like Firebase or Auth0 is not that.
- llamataboot 5y agoIf I'm checking my email, I may as well use 2FA. What I want is smarter auth systems that are better at determining how weird something is. Is it completely secure, no, but for example Heroku now has a ridiculously short session timeout, even when I'm logging in from the same browser, same machine, same IP address, come back to check something a few hours later and I'm completely logged out. Why? I must say I'm confused about hating passwords as a /developer/ though. Even the smallest web frameworks generally have well-documented frequently used auth solutions. Setting up users/passwords and even 2FA at this point is basically a lego block everywhere.
- scim-knox-twox 5y agoI hate logging in with emails. Password manager is the best solution. I prefer not to make login dependent on phone/email access. I always use login + password, I don't need additional devices / tools (which make the whole process more difficult).
- ochrist 5y agoA password manager is also an additional tool, isn't it?
- scim-knox-twox 5y agoNo. It's a password _manager_ - I can log in without it, it's just less comfortable.
- enriquto 5y agoHah! from the point of view of the user, this is already possible even with password-based sites. Instead of logging-in with your previous password (which of course you forgot), you just claim that you lost it and request a recovery email each and every time. I do this almost systematically and I'm happy with that.
- k__ 5y agoYes, lol. So, why not cut out the middle man?!
- sascha_sl 5y agoAh, Math.random for generating credentials. In 25 separate function calls. I know v8 probably inlines them, but that just feels very wrong. We got base58 for these cases.
- Darkstryder 5y agoI did that for a side-project a few years back. This was very elegant to implement: I was happy not having to store any password hashes (which is a dangerous thing to store as password reuse is prevalent) while still ensuring that my users had a secure way to interact with my service. Still, this confused the heck out of some users. Some people kept forgetting the email address they used to sign up and were asking me why their account had been 'duplicated'. I had deliberately blurred the line between signing in and signing up and in practice it backfired a bit. I would not try that for a mainstream service nowadays.
- deleted 5y ago[deleted]
- code_runner 5y agoThe first app I used that implements this is a great little campsite reservation app. I usually come there from an email notification anyways and I find it much less annoying than fumbling for my phone to dig out a 2fa code.
- deleted 5y ago[deleted]
- est 5y agoI was thinking something like this, but instead of no pwd at all, replace pwd with OTP. Many sites require some kind of OTP anyway. Is it secure to use email+otp only for login authentication?
- marginalia_nu 5y agoThis is actually kind of a vulnerability in itself. It would be very easy for a competitor or random bag of dicks to cause your server to flood an email server with emails. Not that this will harm the recipient server, but you can easily find your email server blacklisted because of it, effectively locking every single one of your users out of their accounts. I don't know what's a good mitigation strategy, since this can come from a botnet. Maybe just a global rate limit across all users that allows for some bursts.
- istjohn 5y agoHow is this any more of a problem than the conventional password reset email?
- marginalia_nu 5y agoIf you try to reset your password too often, especially without logging in, you often end up with a "try again in 48 hours or contact support here", to prevent this type of attack. That doesn't really work if this is how you log into your account. The expected rate of these emails is much higher, so you can't be as restrictive in sending them out. Another difference is that the ramifications are much bigger. If your password reset doesn't work, the minuscule fraction of users that can't remember their password can't log in. In this scheme, none of your users can log in.
- k__ 5y agoWhy not limit it to one email every five minutes or something?
- marginalia_nu 5y agoWell let's hypothesize I have a botnet and either I've spent a few months creating accounts, or I just have a list of email addresses from some breached site, and my army of 30,000 color changing lightbulbs and smart fridges are spamming login requests as fast as you'll let them. That's still a lot of emails even if just some are legit. Your option at that point is basically shutting down logins for everyone, or find yourself blacklisted.
- WinstonSmith84 5y agoThere are safer and more convenient passwordless authentication than this: crypto wallets (Metamask, Phantom, Terra Wallet just to name a few). It's all about the same, the user is prompted to sign a message with his private key, which can be verified on the back-end (and before someone asks: it doesn't involve a transaction with any blockchain thus is free and immediate).
- k__ 5y agoYes, but going with email is probably the best for Web2.
- JoeAltmaier 5y agoI wonder why we have username/password. It seems to me, if you have a properly randomized password then you only need that. It's completely identifying. Copy your 256-bit key in from your password vault and voila. Usernames are pretty lame anyway. They're just a 'guess a cute name nobody else used yet' game.
- AlbertVAustin 5y agoHow would you address other users? Using SHA of the password?
- forgotpwd16 5y agoYou can say what is suggested is similar to tripcodes used in some imageboards. If you put `User##password` (where `User` is optional) in the name field when you post something your name will be displayed (differs in each site) like `User!!rEkSWzi2+mz`. So your "account" is the password, no username is needed, and you can have a nickname if you want.
- JoeAltmaier 5y agoFolks could/should have as many contact aliases as they desire. They can send them securely to others whom they want contact with. A single username per customer is a lame approximation to what humans really want/need. Further, it's not necessary to be a unique name - there are plenty of Joe's in the world already. It's not ambiguous if you're contacting the Joe you know. In any case the username is unnecessary when authenticating. Why not prompt for address, or mother's maiden name too? It's all the same sort of weak 'authentication' that could be eliminated with a proper password/access key.
- k__ 5y agoIsn't it even more secure, because you don't have any password that could be leaked? I was thinking about simplifying my setup by replacing Auth0 with Mailgun.
- istjohn 5y agoExecute Program[1] uses this, and while I was initially annoyed at having to check my email to log in, it has grown on me. I only have to do the email step once in a while since the auth cookie is long-lived. And even though the traditional password approach would be marginally easier for me since I use 1Password, I can't help but appreciate the simplicity that comes with eliminating the password altogether. 1. https://www.executeprogram.com/ https://www.executeprogram.com/
- matthewfcarlson 5y agoThat's exactly the vibe that this project is going for. Ideally you should only have to do the email login dance when signing in from a new computer
- forgotpwd16 5y agoAnother site that uses this method is mmm.page.