5 ms·

I think the "magic link" (a.k.a passwordless) method of authentication is actually great for the average user, particularly as many (most?) of them will be on m

I think the "magic link" (a.k.a passwordless) method of authentication is actually great for the average user, particularly as many (most?) of them will be on mobile, where passwords are an absolutely pain. They're also useful as you don't have to use email, you can instead send out the link via SMS, WhatsApp etc. which can drive people to mobile (if that's what you want). That said, here on HN you will probably get a different response, as people here are generally power-users and much more privacy and security aware (not a bad thing). There was a good discussion on this yesterday: https://news.ycombinator.com/item?id=32080540 https://news.ycombinator.com/item?id=32080540 I'd be interested to hear the security argument for or against magic links.

devdiary 4y ago
Agree. I want to hear the same about magic links. The thread you linked about does not talk in context of an "average user". Security choices we make in context of an average-user vs power-user can be a lot different.
romanhn 4y ago
Magic links improve security on a couple of fronts. For one, they prevent users from making weak passwords, which let's face it, most people likely fall into this category. One could argue that strong password requirements do the same, but in reality they compel many users to reuse the same "strong" password, weakening security overall. Magic links prevent this entirely. Secondly, they protect users from weak auth implementations, leaked password hashes, passwords stolen through brute force attacks, etc. Because there are no passwords. I don't have much of a security argument against magic links. I suppose an attacker that gets access to your email now automatically has access to the application. But frankly that is true for passworded apps as well, given the "forgot my password" workflows out there.
- devdiary 4y ago
  Completely agree with that

devdiary 4y ago

Agree. I want to hear the same about magic links. The thread you linked about does not talk in context of an "average user". Security choices we make in context of an average-user vs power-user can be a lot different.

romanhn 4y ago

Magic links improve security on a couple of fronts. For one, they prevent users from making weak passwords, which let's face it, most people likely fall into this category. One could argue that strong password requirements do the same, but in reality they compel many users to reuse the same "strong" password, weakening security overall. Magic links prevent this entirely. Secondly, they protect users from weak auth implementations, leaked password hashes, passwords stolen through brute force attacks, etc. Because there are no passwords. I don't have much of a security argument against magic links. I suppose an attacker that gets access to your email now automatically has access to the application. But frankly that is true for passworded apps as well, given the "forgot my password" workflows out there.

devdiary 4y ago
Completely agree with that