7 ms·

I hate them. Force me to go to my mailbox while I have a good password manager and just want to use that instead. I get the idea, but this should be an alternat

I hate them. Force me to go to my mailbox while I have a good password manager and just want to use that instead. I get the idea, but this should be an alternative, not a default. Also sends loads of single use emails that will remain for ever in users mailboxes.

joe_fishfish 4y ago
If it's magic link or multi-factor authentication, I know which one I prefer. Try explaining to an MFA-loving service that your phone is out of action while it's being repaired.
- deleted 4y ago
  [deleted]
- movedx 4y ago
  Microsoft Authenticator - syncs your codes to the Cloud so you can pull them elsewhere (which your phone is out of action.)
  - lostmsu 4y ago
    Doesn't that defeat the purpose to a degree?
    - rakoo 4y ago
      There needs to be a way to sync everywhere except the device you're connecting from
    - gorjusborg 4y ago
      I use MS authenticator, and had the same thought. I came to grips with the idea that I really don't care all that much if a single factor has risks as long as the other factors have orthogonal lists.
    - WorldMaker 4y ago
      Microsoft thinks it is fine for most user's threat models because these use two stacked layers of encryption: your Microsoft account and either Apple's cloud backup encryptions or Google's. To move these codes between devices you have to login in both your Microsoft account and also your Apple or Google account in quick succession. I know on Apple devices it works in the same (iCloud) backup layer that disables other device keys so doing this on a new device will "break" access on the previous device (only one device at a time has access). (I'm not sure about Google's ecosystem.) You can't easily switch ecosystems with this. Microsoft seems to think it unlikely enough that both your Microsoft account and your device ecosystem account will be compromised at the same time that there is enough security in this depth.
  - contravariant 4y ago
    Last time I tried that I still had to reactivate all the accounts. Storing them in Bitwarden is more convenient by far, but storing TOTP is a paid feature.
    - movedx 4y ago
      I use 1Password, but I'm not sure storing the OTP next to the password is a good idea?
      - contravariant 4y ago
        The idea is that you protect your password vault with 2FA and a strong password. It slightly raises the risk in the scenario where your password vault gets hacked, but like with putting all your passwords in the same place, if you've only got 1 place to protect it becomes easier to protect it more thoroughly.
- dymk 4y ago
  1password and Lastpass both manage MFA codes and work cross-device. If your phone is your only way to get into MFA protected accounts, you're doing it wrong. What happens if you can't repair your phone?
  - amacneil 4y ago
    If you're storing your "multi-factor" authentication codes in the same place (ahem, "factor") as your password, you're doing it wrong.
    - phphphphp 4y ago
      I used to think this but I don’t agree any more. A factor is a factor: your service password + your password manager password = 2 factors. Yes, if someone compromises your password manager then you’re in a bad position but that’s not what service-level multi-factor authentication protects against.
      - amacneil 4y ago
        > that’s not what service-level multi-factor authentication protects against I don't understand your point. This is exactly what multi-factor authentication protects against if you don't store your MFA codes in your password manager.
        waihtis 4y ago
        A password may be compromised via other routes than just through a password manager hijack, which is probably far down the probability scale of all of the possible ways to do so
    - az_reth 4y ago
      Except you're still protected whenever a website gets breached and all their passwords are dumped. Sure it's still a single point of failure but at least it's with a company dedicated to password security.
- acdha 4y ago
  Here's what that's like with WebAuthn: 1. Use my Yubikey with a different phone via NFC or a different computer using USB 2. Login using my other iPhone or Mac because the WebAuthn passkey is synced via iCloud (this is in the progress of coming to Chrome & Windows) The nice thing is that all of those are more convenient than using email in addition to being more secure.
- Macha 4y ago
  Does your email not use MFA? So the choice not between magic links or MFA, it's between magic links and MFA or just MFA?
codingdave 4y ago
I'm mildly surprised that one of your complaints is that these fill your email. It seems simple enough to delete them?
- sp332 4y ago
  Once I click the link, it takes me away from my email inbox. That means I have to go back and clean them up later. That's extra work for something that should be ephemeral. No thanks. I can't quite put my finger on why it's different from having SMS 2FA codes in my Signal inbox, but it feels like more clutter.
  - IggleSniggle 4y ago
    SMS clutter is worse for me. Harder to delete in bulk.
    - sn0wleppard 4y ago
      My SMS inbox is almost entirely login codes and other automated stuff so I'm quite happy just to leave it all there
      - corrral 4y ago
        Ditto my non-work email, really. Humans are in chat apps. Text, email, phone—overrun by transactional messages from computers, and spam.
- 8organicbits 4y ago
  Gmail app buries delete in a couple places in favor of archive. I routinely find I need to open a message to delete it, although the notification has an "archive" quick action button. Gmail made delete extra steps. I have virtually unlimited space for email, but they still show up in searches, and I'm certain I'll never want to look at them again.
  - twistedpair 4y ago
mmikeff 4y ago
I also hate them, my email is slow and mobile internet is almost non-existent at my house, so now I am waiting for an email to arrive in my inbox before I can login, or I am waving my phone around trying to get reception to receive a code. I'm sure I am not the only one with those issues. As said above, this would all be fine if Magic Link was an option rather than the only way to sign in.
ajvs 4y ago
Yeah this is a huge turn off when using Notion especially.
postalrat 4y ago
They should be the default because they are more secure than a password plus a email password reset.
tebbers 4y ago
The problem is that most users still don’t have password managers and actually magic links are more secure for them because they’re not vulnerable to password stuffing.
notnotjake 4y ago
It would be really interesting if 1Password or another could have an "email client" that just looks for these codes/links the same way iOS/macOS look for messages 2FA codes

joe_fishfish 4y ago

If it's magic link or multi-factor authentication, I know which one I prefer. Try explaining to an MFA-loving service that your phone is out of action while it's being repaired.

deleted 4y ago
[deleted]
movedx 4y ago
Microsoft Authenticator - syncs your codes to the Cloud so you can pull them elsewhere (which your phone is out of action.)
- lostmsu 4y ago
  Doesn't that defeat the purpose to a degree?
  - rakoo 4y ago
    There needs to be a way to sync everywhere except the device you're connecting from
  - gorjusborg 4y ago
    I use MS authenticator, and had the same thought. I came to grips with the idea that I really don't care all that much if a single factor has risks as long as the other factors have orthogonal lists.
  - WorldMaker 4y ago
    Microsoft thinks it is fine for most user's threat models because these use two stacked layers of encryption: your Microsoft account and either Apple's cloud backup encryptions or Google's. To move these codes between devices you have to login in both your Microsoft account and also your Apple or Google account in quick succession. I know on Apple devices it works in the same (iCloud) backup layer that disables other device keys so doing this on a new device will "break" access on the previous device (only one device at a time has access). (I'm not sure about Google's ecosystem.) You can't easily switch ecosystems with this. Microsoft seems to think it unlikely enough that both your Microsoft account and your device ecosystem account will be compromised at the same time that there is enough security in this depth.
- contravariant 4y ago
  Last time I tried that I still had to reactivate all the accounts. Storing them in Bitwarden is more convenient by far, but storing TOTP is a paid feature.
  - movedx 4y ago
    I use 1Password, but I'm not sure storing the OTP next to the password is a good idea?
    - contravariant 4y ago
      The idea is that you protect your password vault with 2FA and a strong password. It slightly raises the risk in the scenario where your password vault gets hacked, but like with putting all your passwords in the same place, if you've only got 1 place to protect it becomes easier to protect it more thoroughly.
dymk 4y ago
1password and Lastpass both manage MFA codes and work cross-device. If your phone is your only way to get into MFA protected accounts, you're doing it wrong. What happens if you can't repair your phone?
- amacneil 4y ago
  If you're storing your "multi-factor" authentication codes in the same place (ahem, "factor") as your password, you're doing it wrong.
  - phphphphp 4y ago
    I used to think this but I don’t agree any more. A factor is a factor: your service password + your password manager password = 2 factors. Yes, if someone compromises your password manager then you’re in a bad position but that’s not what service-level multi-factor authentication protects against.
    - amacneil 4y ago
      > that’s not what service-level multi-factor authentication protects against I don't understand your point. This is exactly what multi-factor authentication protects against if you don't store your MFA codes in your password manager.
      - waihtis 4y ago
        A password may be compromised via other routes than just through a password manager hijack, which is probably far down the probability scale of all of the possible ways to do so
  - az_reth 4y ago
    Except you're still protected whenever a website gets breached and all their passwords are dumped. Sure it's still a single point of failure but at least it's with a company dedicated to password security.
acdha 4y ago
Here's what that's like with WebAuthn: 1. Use my Yubikey with a different phone via NFC or a different computer using USB 2. Login using my other iPhone or Mac because the WebAuthn passkey is synced via iCloud (this is in the progress of coming to Chrome & Windows) The nice thing is that all of those are more convenient than using email in addition to being more secure.
Macha 4y ago
Does your email not use MFA? So the choice not between magic links or MFA, it's between magic links and MFA or just MFA?

codingdave 4y ago

I'm mildly surprised that one of your complaints is that these fill your email. It seems simple enough to delete them?

sp332 4y ago
Once I click the link, it takes me away from my email inbox. That means I have to go back and clean them up later. That's extra work for something that should be ephemeral. No thanks. I can't quite put my finger on why it's different from having SMS 2FA codes in my Signal inbox, but it feels like more clutter.
- IggleSniggle 4y ago
  SMS clutter is worse for me. Harder to delete in bulk.
  - sn0wleppard 4y ago
    My SMS inbox is almost entirely login codes and other automated stuff so I'm quite happy just to leave it all there
    - corrral 4y ago
      Ditto my non-work email, really. Humans are in chat apps. Text, email, phone—overrun by transactional messages from computers, and spam.
8organicbits 4y ago
Gmail app buries delete in a couple places in favor of archive. I routinely find I need to open a message to delete it, although the notification has an "archive" quick action button. Gmail made delete extra steps. I have virtually unlimited space for email, but they still show up in searches, and I'm certain I'll never want to look at them again.
- twistedpair 4y ago

mmikeff 4y ago

I also hate them, my email is slow and mobile internet is almost non-existent at my house, so now I am waiting for an email to arrive in my inbox before I can login, or I am waving my phone around trying to get reception to receive a code. I'm sure I am not the only one with those issues. As said above, this would all be fine if Magic Link was an option rather than the only way to sign in.

ajvs 4y ago

Yeah this is a huge turn off when using Notion especially.

postalrat 4y ago

They should be the default because they are more secure than a password plus a email password reset.

tebbers 4y ago

The problem is that most users still don’t have password managers and actually magic links are more secure for them because they’re not vulnerable to password stuffing.

notnotjake 4y ago

It would be really interesting if 1Password or another could have an "email client" that just looks for these codes/links the same way iOS/macOS look for messages 2FA codes