3 ms·

Fuck magic links. What a horrible login flow. Am I the only person taht doesn't have my email open in another tab?

by tomc1985 4y ago

jjoonathan 4y ago
My favorite is when a vacation or network change triggers what amounts to a cascade of security audits. Site A sends magic link to Email B, which in turn sends text to phone C but it never arrives, so everything times out. On the next go, Email B can be persuaded to send magic link to Email C which now wants a ubikey or password you haven't used in years. A simple login turns into an hour long slog -- with landmines! So far, I have been careful enough, but it's only a matter of time until this bites me.
smt88 4y ago
> Am I the only person taht doesn't have my email open in another tab? Magic links aren't targeted at the type of user you seem to be. Most users of most products are: 1) on mobile devices, and 2) use a native email client. They also don't have password managers, so magic links become a way to assume the security level of their personal email (which is what "forgot password" ends up doing anyway).
- tomc1985 4y ago
  It doesn't matter. Crap like this makes the web worse. We cannot keep catering to people who refuse to learn better practices. If the industry got itself together enough to start teaching people good internet hygiene we'd all be much better off. But instead we strip away OK security for horrible security, and inconvenience nearly everyone in the process.
  - smt88 4y ago
    Magic links are better security than most people's use of passwords. I can't count the number of people I know who reuse the same password on every site or just use terrible passwords. It took me years to get my dad and girlfriend on a password manager, and they're the only family I've succeeded with. It's the same with privacy. I could never get anyone to leave Gmail. You can't sell people on a major "inconvenience" by telling them about a hypothetical security breach. It's just not human nature. And even worse, the only good password manager that I've used is 1Password and it isn't free.

Fuck magic links. What a horrible login flow. Am I the only person taht doesn't have my email open in another tab?

My favorite is when a vacation or network change triggers what amounts to a cascade of security audits. Site A sends magic link to Email B, which in turn sends text to phone C but it never arrives, so everything times out. On the next go, Email B can be persuaded to send magic link to Email C which now wants a ubikey or password you haven't used in years. A simple login turns into an hour long slog -- with landmines! So far, I have been careful enough, but it's only a matter of time until this bites me.

smt88 4y ago

> Am I the only person taht doesn't have my email open in another tab? Magic links aren't targeted at the type of user you seem to be. Most users of most products are: 1) on mobile devices, and 2) use a native email client. They also don't have password managers, so magic links become a way to assume the security level of their personal email (which is what "forgot password" ends up doing anyway).

tomc1985 4y ago
It doesn't matter. Crap like this makes the web worse. We cannot keep catering to people who refuse to learn better practices. If the industry got itself together enough to start teaching people good internet hygiene we'd all be much better off. But instead we strip away OK security for horrible security, and inconvenience nearly everyone in the process.
- smt88 4y ago
  Magic links are better security than most people's use of passwords. I can't count the number of people I know who reuse the same password on every site or just use terrible passwords. It took me years to get my dad and girlfriend on a password manager, and they're the only family I've succeeded with. It's the same with privacy. I could never get anyone to leave Gmail. You can't sell people on a major "inconvenience" by telling them about a hypothetical security breach. It's just not human nature. And even worse, the only good password manager that I've used is 1Password and it isn't free.