22 ms·

Magic/tragic email links: don't make them the only option

• withinboredom 2y ago
  Let me tell you about the time Epic's magic links were delayed six hours. I couldn't login to fortnite. It was absolutely tragic. /s
• j16sdiz 2y ago
  Usability issue aside. ... Using SMTP as the only login factor sounds very insecure to me.
• technick 2y ago
  Magic links are a easy way to move the responsibility of security off to the user and remove the risk of managing access controls.
• dbalan 2y ago
  The 404 article irked me a lot, thanks for writing this.
  • gepeto42 2y ago
    You're welcome. Been thinking about it for a few days, and I had to do it. I don't disagree there's some benefits but being told "IT'S BETTER!" annoyed me quite a bit.
• billy99k 2y ago
  I've never liked magic links. I've found multiple sites that will just clobber the existing login session when you access the magic link, meaning someone could trick you into logging into another account.
  • Pxtl 2y ago
    I like magic links (as long as they self-renew the cookie so I never have to log in again) but you do highlight the critical need for a good landing page if you use them, like "are you sure you want to log in as SomeUserNameGuy? You're currently logged in as SomeOtherUserNameGuy."
• imzadi 2y ago
  Firewall blocks that link
  • ceejayoz 2y ago
    Probably the entire .zip TLD.
    • gepeto42 2y ago
      Yeah. To be honest, I kind of setup this blog as a joke when the dot zip gTLD came up, as an inside joke with a few fellow security people who (rightfully) are against the ever expanding list of TLDs we have to deal with.
      • Mystery-Machine 2y ago
        What's wrong with ever expanding list of TLDs? Is there a security threat or you just don't like it or?
        • gepeto42 2y ago
          Some of them make it way easier for threat actors to obtain large amounts of domains for cheap or free, without fear they'll disappear right away. Paul Vixie had a great talk and research about this ~2018: https://www.youtube.com/watch?v=nkoNjntc5Lw https://www.youtube.com/watch?v=nkoNjntc5Lw
      • billpg 2y ago
        Because of the risk of auto-linkification, I'm of the opinion that browsers should put the entire dot-zip domain into the this-is-dangerous realm with big scary warnings if anyone follows a link. (Or at least any file downloads.)
  • gepeto42 2y ago
    Because I'm an idiot who likes hosting stuff on bad gTLDs, here's the markdown content of the actual post for you and everyone behind some corporate firewall that blocks dot zip: The term "Magic Links" once meant a [futuristic PDA](https://en.wikipedia.org/wiki/Magic_Link https://en.wikipedia.org/wiki/Magic_Link). Nowdays, companies like [Auth0](https://auth0.com/docs/authenticate/passwordless/authentication-methods/email-magic-link https://auth0.com/docs/authenticate/passwordless/authenticat...) use it to refer to the slightly-magical feat of including a login link in an email. Last week, the great website you should subscribe to if you haven't already (it's great, when you're not logged out), [404 Media](https://www.404media.co/ https://www.404media.co/), posted ["We Don't Want Your Password"](https://www.404media.co/we-dont-want-your-password-3/ https://www.404media.co/we-dont-want-your-password-3/) in defense of so-called magic links. Of course, as stated in the article, such email links are harder to phish than passwords, can't lead to a breach of passwords, and protect the site itself against users who might reuse passwords previously compromised. The article even covers some of my annoyances with this system, but throws out this sentence: > [We find this to be a much easier login process and wish it was more common across the web where appropriate.](https://www.404media.co/we-dont-want-your-password-3/ https://www.404media.co/we-dont-want-your-password-3/) Easier than what? Easier than a long password, without a password manager? Easier than a passkey? Easier than an OTP sent to the same email address? This sentence reads to me as one written by someone mostly working and _living_ from a single laptop and mobile device. The second part of the sentence, calling for more sites to do this is why I am writing this. For any scenario with a minimal amount of complexity, like users with multiple computers, and you're looking at a scenario where the site's unwillingness to deal with other login methods shoves friction on the end-user. ### What makes them tragic: 1. Multiple devices. Who doesn't use at least a few computers weekly? I don't have my email on my gaming PC, nor do I have it on my work laptops. 1. Slower. From 2 seconds slower to minutes slower, depending on SMTP delays as well as how awkward it is to get the link to the right browser. 1. Anti-mobile. As mentioned by 404 in their own article, this breaks the ability to use in-app browsers, which is quite annoying especially for RSS reader type apps. It makes interacting with any local link in the RSS feed extremely annoying. 1. Indirect security downsides. Pushing people to access personal email on work devices (or vice-versa) isn't exactly a win for security. Another annoying _passwordless_ system is to email or SMS an OTP the end user can type in. While this sucks, it at least allows you to easily log in in situations where you don't have a clear and easy copy/paste path from the email client to the browser you want to log in to. [Stratechery](https://stratechery.com/ https://stratechery.com/), powered by [Passport](https://passport.online https://passport.online), uses this type of scheme (click link OR type in OTP), which is still shifting annoyances onto end-users to free developers from implementing passkeys, but at least has a bit more of an appreciation for end-users. If you insist on using magic/tragic links by default, at least consider offering a robust alternative, such as [passkeys](https://fidoalliance.org/passkeys/ https://fidoalliance.org/passkeys/), especially if your audience is technical and privacy-focused.
• jameshart 2y ago
  Best implementation I see of this requires you to click the link on whatever device you receive the email on, but it doesn’t transfer the session there - it just triggers completion of the login process on whatever device you initiated the process on.
  • megous 2y ago
    A phisher's dream.
    • gepeto42 2y ago
      Yeah exactly. Plus, sometimes SOMETHING will click the link before it even gets to the person's inbox (some enterprise spam filter with a sandboxed browser for example). edit: saw that nicce basically said that a second before I hit post.
    • nicce 2y ago
      All the email scanners likely trigger the process anyway.
    • jameshart 2y ago
      Solvable with the right information in the authorizing email. Remember that the flow the magic link is part of is one you initiate, that causes you to get an email you are expecting. That email, and the landing and confirmation page it links you to, can explain very clearly that you are only supposed to authorize this if you are trying to log in on known device in known location that is displaying recognizable number on the screen right now.
      • Mystery-Machine 2y ago
        You're assuming users read.
      • avidiax 2y ago
        Rather than a recognizable number, users should be prompted to select a matching non-pronounceable glyph. Something like the keypads from KTANE [1]. That makes it impossible to text or speak it to a phisher. Bonus points if you show the symbol as a noisy animated glyph, something like [2], or a link to a DRM'd video showing a symbol. That would make it very difficult to view even with screen recording or remote desktop software. [1] https://www.bombmanual.com/web/index.html#:~:text=On%20the%20Subject%20of%20Keypads https://www.bombmanual.com/web/index.html#:~:text=On%20the%2... [2] https://www.youtube.com/watch?v=RNhiT-SmR1Q https://www.youtube.com/watch?v=RNhiT-SmR1Q
• catchmeifyoucan 2y ago
  From a developer perspective, I like magic links. They help verify an e-mail address, and log you in at the same time.
  • Mystery-Machine 2y ago
    Like there's no other way to verify an email address. From a developer perspective, I hate it, because it's yet another functionality that I need to add and support in my app.
    • Glyptodon 2y ago
      Why doesn't sending an OTC to an email and marking it verified if they put in the code also work?
• marketneutral 2y ago
  claude.ai supports only either magic email links or google sign in. definitely a factor in why I prefer ChatGPT.
  • airstrike 2y ago
    I also find their magic link annoying, but since claude.com doesn't log me out all of the god damn time like chatgpt.com does, Claude is winning this round too...even though this is not a factor in why I prefer one vs the other.
  • rtsil 2y ago
    I just signed up for Claude yesterday and I didn't even realize that I didn't enter a password. It was when I wanted to use it on my phone (with Firefox, not the app) that I realized that there was no Claude entry in my password manager. It made me irrationally angry for about 5 minutes, and had I known it in advance, I would probably not have bothered.
  • tacker2000 2y ago
    Also encountered this today and I didnt remember what email I used to login, so I tried both but now I seem to have 2 claude accounts, ugh…
• pjerem 2y ago
  I like the Kagi qrcode login option. You scan the QR code with any device you are already logged in and boom, you can login with a button. Its like steam guard but with no app. It’s in fact so simple that I don’t understand why it’s not universal. You still need another method for the first login.
  • NobodyNada 2y ago
    The biggest disadvantage of this scheme is that if a malicious actor can trick you into scanning an arbitrary QR code, they can get access to your account (by visiting the login page themselves to generate a QR code, and then sending you the code). Discord implements this feature, and this phishing scheme is extremely common: bots/scammers will message you saying "to access <some desirable content>, please scan this QR code" -- and if you scan the code, the scammers have just taken over your account. It's not much harder than rickrolling someone unless they're savvy enough to be aware of the scam. Of course this can be mitigated somewhat by putting a big scary confirmation screen that says "don't click continue unless you're trying to log into your account from another device", but 1) users don't read, they just click "continue"; and 2) the attacker controls the narrative before the user clicks the QR code; they can craft the language to make the scary warning screen make sense to the user ("yes, I am trying to log into this discord server that this person sent me an QR code to").
    • apitman 2y ago
      I feel like there should be a way to implement this in a phishing-resistant way. Maybe instead of a QR code some sort of video stream that updates dynamically? That would at least be much more difficult for attackers to pass through to the victim.
• Mystery-Machine 2y ago
  > What makes them tragic: > 1. Multiple devices. Who doesn’t use at least a few computers weekly? I don’t have my email on my gaming PC, nor do I have it on my work laptops. "Who doesn’t use at least a few computers weekly?" I don't. And many, many other people. See what I did there? I assumed that everyone's like me, just like you did in your blog post. Without data, both of us are wrong. ---- I'd add that magic links also act as a distraction: you open your email client, and it by default opens your inbox, and you start going through all of those unread emails that you just found in your inbox... Shopify is a big proponent for magic links because they went all-in on their new "Shop" customer accounts. What a disaster. Branding something with such a generic word as "shop" is terrible and average customer doesn't understand that it's supposed to be a brand name.
  • kens 2y ago
    Shop is the same as Shopify? Thank you (seriously) for pointing this out. I've been getting Shop emails and I had no idea.
    • Mystery-Machine 2y ago
      Haha. Thanks for proving my point!
  • benoliver999 2y ago
    I've not seen Shop but always liked the simple ShopPay UX.
  • codazoda 2y ago
    I got one of these a couple days ago. I thought it was a well timed scam at first.
  • Macha 2y ago
    > "Who doesn’t use at least a few computers weekly?" > I don't. And many, many other people. When you consider that a smartphone is "another" computer (or for many users, the computer that is not the smartphone is the "other" computer), I imagine that number goes way up. Someone using a computer at work and a personal phone, for example.
• rickcarlino 2y ago
  Issues I’ve encountered building an app with magic links: 1. Include a fallback sign-in code in your magic link, in case the user needs to log in on a device where accessing their email isn’t practical. 2. Make sure the sign-in link can handle email clients that open links automatically to generate preview screenshots. 3. Ensure the sign-in link works with email clients that use an in-app browser instead of the user’s preferred browser. For example, an iOS user might prefer Firefox mobile, but their email client may force the link to open in an in-app browser based on Safari.
  • michaelmior 2y ago
    > Make sure the sign-in link can handle email clients that open links automatically to generate preview screenshots. Any suggestions on what needs to be handled here? My first thought is UA checking to see if it looks like a real browser.
    • nine_k 2y ago
      E.g. require to click a button to actually sign in, don't consume the token and establish the session on mere URL access.
    • rickcarlino 2y ago
      In my app, I just added an “Almost there!” Page with a button that the user needs to click. I still need to add a fallback option that uses a one time code for the other reasons mentioned above.
    • timfsu 2y ago
      Using a time-based expiration rather than a usage-based expiration should help
    • snthd 2y ago
      The link is a "safe" GET request. The page loaded via the link should do an "unsafe" POST for the login, via javascript with a form button for fallback. https://www.rfc-editor.org/rfc/rfc7231#section-4.2.1 https://www.rfc-editor.org/rfc/rfc7231#section-4.2.1 >The purpose of distinguishing between safe and unsafe methods is to allow automated retrieval processes (spiders) and cache performance optimization (pre-fetching) to work without fear of causing harm. In addition, it allows a user agent to apply appropriate constraints on the automated use of unsafe methods when processing potentially untrusted content. Exactly the same for email unsubscribe links, or a one click "buy now" link.
• scott_w 2y ago
  Honestly, having run a number of experiments with magic link, I wouldn’t recommend them. We saw our login success drop noticeably. We tried a few different approaches over the course of a quarter but even our best attempt only mitigated the drop compared to having email/password and Google Login. Obviously, your mileage may vary but it was a good reminder to always validate your assumptions, especially in your critical user flows.
  • sebastiennight 2y ago
    I'm super interested as we've been debating adding email/password (since we only use Magic Links at the moment). How are you tracking login success rates?
    • scott_w 2y ago
      Pretty straightforward: you send an event for which variation your user saw and another when they login, attaching the login method to the attributes. You can use Mixpanel or Heap, which have mechanisms for mapping the non-logged-in user to your verified user on login, though you might need a bit of custom code to do it.
      • sebastiennight 2y ago
        Ah. We use June.so ; I'm assuming they might have a similar mechanism. We'll try and log login attempts so we can track this. Thank you!
        • scott_w 2y ago
          No worries! Our experience is that the hardest part (and it's not trivial) is associating the "anonymous user ID" to the newly logged-in user. Segment has an identify() function (I think Mixpanel has something similar), where you link the aliases, which then makes the reporting work. I've not tried June, so I can't say for sure, but it's a pretty common feature for product analytics. I'll be surprised if it's not possible.
• scarface_74 2y ago
  > Stratechery, powered by Passport, uses this type of scheme (click link OR type in OTP), which is still shifting annoyances onto end-users to free developers from implementing passkeys, but at least has a bit more of an appreciation for end-users. With Stratechery, once you get to the website with the magic link, I can then copy the authenticated podcast RSS feed to Overcast and the authenticated RSS feed for the articles to NetNewsWire. Those subscriptions are then synced to Overcast and NNW on my iPad and Mac via iCloud. Each podcast RSS link is personalized and you go to the show notes page and click on the link to Manage your account. It will take you to the website using the embedded browser where you can manage your subscription and get access to the various feeds. Speaking of Overcast, even though its doesn’t create a username and password by default, you can create one. But it’s only to access the web version of Overcast.
  • gepeto42 2y ago
    Yeah the Stratechery implementation for podcasts is great. The more annoying thing is each of them has its own domain and requires logging in, if you don't know you can dig into Stratechery.com. I would prefer if I could login to it with a passkey or username+pwd, but it's a much better system overall than just dropping an email link.
    • scarface_74 2y ago
      Once you subscribe to one of the podcasts, you can choose the “Manage your account” link from the podcast notes and choose the “Delivery Tab”. It will give you all of the links to all of your podcasts. I did this from the “Dithering” podcast notes https://imgur.com/a/ThbTaly https://imgur.com/a/ThbTaly
• yawaramin 2y ago
  Way better option: emailed OTP code and passkey with Conditional Mediation UI. If the user is logging in from a device that already has a passkey, the CM UI will let them just select it and log in instantly. If they are logging in from a device which doesn't, we can make the UX such that it asks them to enter the emailed code, and after that is successfully it immediately asks the user to set up a passkey for instant sign-in. This gets the best of both worlds: the security of passkeys on existing devices, and the passwordless setup and account recovery for new devices. Bonus: it even avoids vendor lock-in where cloud providers have all your passkeys.
  • pat2man 2y ago
    Asking users to enter an emailed code does not protect against MITM attacks unfortunately
    • yawaramin 2y ago
      True, but pushing passkeys as the primary auth method reduces the risk to a great extent. It's a huge difference. As long as the user keeps using a relatively stable set of devices, they will 'approximately never' be exposed to MITM. Also, when logging in from a new device, many accounts which use password-based auth today send a confirmation email and ask users to either enter the emailed code or click on the link. This is part of their existing security protocol. So we are not introducing a new unique thing here.
      • lolinder 2y ago
        > As long as the user keeps using a relatively stable set of devices, they will 'approximately never' be exposed to MITM. As long as the user keeps a relatively stable set of devices and knows to be suspicious if they get asked for an OTP on a device that they know has a passkey. If they don't know to be suspicious (which let's be real, most people won't), they'll happily follow the instructions and fork over the OTP to a phisher who can use it to complete the authentication somewhere on their end. Magic links without an OTP fallback are more secure as the initial setup process because they can't be phished unless someone's actually MITM'ing their HTTPS traffic (at which point nothing can save you anyway). A phisher can get someone to send themselves a magic link, but it's much harder to get them to provide the link to them.
• ejs 2y ago
  I usually implement the whole username/password auth flow, but recently used only magic links for a simple application. Since the application only sends a weekly email (a markdown template for goal/task tracking) it seemed easier to just use a magic link, only. I am happy at how much easier the auth code ended up, and fail to see much downside for such an application. I'm not sure it would be a good system for more complex apps and services.
  • benoliver999 2y ago
    I have a system where users log in extremely infrequently. Tempting to move away from username & password because they just reset every time anyway.
    • ejs 2y ago
      Yeah - that's my thought too, the service I use them for is not something people often log into. Sometimes never.
• t0mas88 2y ago
  I recently encountered a food delivery website that insisted on a magic link / 2FA code check after a password login. Come on... I'm trying to order a pizza. If you want strong security, offer passkey login. It's safer than email and much more user friendly especially with FaceID/TouchID on Apple devices.
• deleted 2y ago
  [deleted]
• kleiba 2y ago
  Sorry to ask - I don't have personal experience using such a system. Would it be possible to bookmark the login link so that in the future I don't first have to go to my email in order to log into the service?
  • Gigachad 2y ago
    No. The links are temporary.
    • kleiba 2y ago
      Oh, I see. Thanks! So, they're basically the second part of 2FA?
      • Gigachad 2y ago
        They aren't really 2FA at all since often you don't need a password. To login you just type your email and enter the code you got from the email or click a link. Shopify works this way where buyers don't have passwords and only log in with codes sent via SMS/Email.
    • davewasthere 2y ago
      And worse (sometimes) consumed by email scanners. There's all sorts of hassles with them. Email deliverability often an issue too.
  • hmof 2y ago
    You stay logged in due to cookies. You don't need to keep the login link.
    • ale42 2y ago
      Except that some people prefer to purge cookies when closing their browsers. And the session typically doesn't last forever, even if you keep the cookies.
• foxhop 2y ago
  [dead]
• lolinder 2y ago
  Am I misunderstanding something, or are passkeys not actually an alternative to magic links? Every implementation of passkeys I've seen has presented me with the option to create a passkey after I've already logged in with some other method. I'll admit that I haven't dug into it deeply, but the UX I've been presented with consistently makes passkeys appear to be an alternative to the "Remember this computer" button, not to passwords in general. Somehow the service has to know that this new device is authorized. I know depending on the provider there's such a thing as passkey syncing, but that doesn't solve the problem of getting the initial authentication done. The key insight with magic links is that your security system is no stronger than its recovery mechanism. We are never going to get to a world where passkeys are treated as the only authentication mechanism—there will always be a recovery mechanism, and in most cases an automated one via email. Given that that is the case, magic links simplify things by just not pretending that we have a more secure layer on top. By making the recovery mechanism the primary means by which you interact with the authentication flow you're being more honest about the actual security of your auth system. Edit: filmgirlcw has a link to an article that is much better than this one that explains how the two actually complement each other: https://news.ycombinator.com/item?id=42628226 https://news.ycombinator.com/item?id=42628226
  • Glyptodon 2y ago
    The first thing I thought when I read this is how can the author make the specific criticisms of links/otp codes and then suggest passkeys, which have pretty much the same issues x10. Like if using a OTP from your phone or copying a link from your phone when using a work PC to visit a website is a pain, how much easier/better/same is it to try and have your work computer work with your personal passkey from a laptop or something?
    • avianlyric 2y ago
      > how much easier/better/same is it to try and have your work computer work with your personal passkey from a laptop or something? Passkeys support authentication via a secondary device over Bluetooth (and this is supported in every major browser on every major platform). So you can login to a site on a machine that’s completely disconnected from your personal passkey store by scanning a QR code with your personal phone. The login flow basically goes “request login with passkey” -> “browser recognises it doesn’t have the needed passkey, and offers a QR code to scan” -> “scan QR code with phone” -> “phone and browser handshake via Bluetooth” -> “passkey handshake happens between website and phone” -> “login completes”. I’ve personally used this flow with my work laptop and my personal iPhone many times. iOS has built in support for the Passkey QR codes, so you can scan the code with the standard camera app. Additionally iOS supports allowing 3rd party passwords managers to take over the Passkey flow once you’ve scanned the QR code. So in my case I complete the flow with 1Password. End-to-end the flow is pretty damn seamless, I’ve never personally had it fail, and take 30seconds to complete. The most annoying part is trying to remember where my phone is.
• filmgirlcw 2y ago
  I think this is really great as a response to 404's post last week. I love 404 but I'm as annoyed by Magic Links as OP for the same reasons they mention. Ricky Mondello wrote a really great blog last week[1] about how passkeys, as OP alludes to at the end, can be used alongside Magic Links, that I think is worth a read. [1]: https://rmondello.com/2025/01/02/magic-links-and-passkeys/ https://rmondello.com/2025/01/02/magic-links-and-passkeys/
  • gepeto42 2y ago
    Thanks for that link, I had not seen it and if I had known Ricky Mondello had written that, I probably wouldn't have bothered. I'm still used to Apple people being almost completely invisible publicly.
    • filmgirlcw 2y ago
      thanks for writing what you wrote -- I think it's important that we have this conversation as broadly as we can
    • cmiller1 2y ago
      I'm confused, what's going on here? Is there a reason you wouldn't have bothered reading a post from that specific person?
      • gepeto42 2y ago
        I meant Ricky’s post is great and if I had known about it first I might not have written mine! Added a link to it at the bottom of mine.
        • cmiller1 2y ago
          Ahh! Thanks for clarifying!
  • lolinder 2y ago
    Thank you, this is a better piece than TFA! Reading TFA I was rather confused at how passkeys are an alternative to magic links—it makes a lot more sense to view them as a complement. Magic links allow you access to passkeys, which are basically "Remember this Computer" on steroids.
• cco 2y ago
  As someone that does this for a living, 100%. Email OTP is a great alternative that splits the difference of magic links vs passwords. Agreed with some other folks that Passkeys is not a replacement for email verification.
• MrDunham 2y ago
  Adding to the article: I seriously HATE magic links. My email inbox is barely better a social network's time suck. Lots of urgent, little important, wrecks any flow I had. Forcing me into my inbox is highly likely to cause me to forget about the reason I was there (to get into your app). Or, at best, it slows me way down and nearly always breaks my flow. Perhaps this is acceptable for the security boost (?) for the average user, but man, when I get forced into magic links I sometimes just abandon the app altogether. Disclaimer: 1. I have/pay for a password manager, which helps with the forgotten password problem a lot. It also allows me to have extremely hard-to-crack passwords.
  • digging 2y ago
    Totally agreed - a correctly used password manager is many, many times easier and faster to use than so-called magic links. It's not even a contest. I'd even say magic link emails border on misuse of email; they're a fundamentally different form of communication from all other uses of email. It's not easy on neurodivergent brains to deal with that combination of pollution (magic links in my inbox) and distraction (actual emails in my face when I'm trying to log in and was not trying to check my email). Protonmail's client could really make my day if they found a way to reliably separate those 2 channels so I didn't have to even open my inbox to get login codes/links. What I don't understand is why I've never been prompted to use a password manager by any site with a signup flow. It seems easier to normalize their use through messaging than keep acting like passwords are supposed to be something you consciously remember. Nobody should remember their passwords, except for maybe 2-3. But now we're moving toward a world where login just means more friction and less control instead...
    • Uvix 2y ago
      Trying to explain to users of an unrelated site how to use a password manager sounds like a support nightmare.
      • digging 2y ago
        That is a very good point! You'd have to be careful to craft the messaging so that it doesn't imply you can help troubleshoot the password manager. But something simple could work. Already you usually have a note under a password field, "Must contain at least 8 characters and at least one special character" or something to that effect. It could also have some note about "We suggest a randomly generated password from your password manager." I'm not building this out so I don't need every hole poked in the idea, just seems like it could work.
• Malcx 2y ago
  Magic links are so useful in specific circumstances. We have a client with hundreds of users that infrequently need access to a bespoke tool. Setting up and managing user accounts for them is out of the question, but a magic link letting them sign in using an email of their corporate domain solves the issue easily.
• rubslopes 2y ago
  I'm having a good experience with a recently implemented magic link system. I did it via WhatsApp instead of email, which is much more reliable. Of course, this is only possible because in my country every single person uses WhatsApp. I'm building something for a very tech illiterate audience, and everybody loves the simplicity of it.
  • apitman 2y ago
    I've wondered about doing this. Does WhatsApp let you send messages to arbitrary users via an API?
    • aembleton 2y ago
      Yes https://business.whatsapp.com/products/conversation-categories/authentication https://business.whatsapp.com/products/conversation-categori...
      • apitman 2y ago
        That looks even better than I hoped. Is this free?
• dpifke 2y ago
  I've been a loyal Mercury customer for a while now, but their forced use of magic links as a third authentication factor any time my IP address changes (after authenticating with a secure password from my password manager and after a valid TOTP) has me ready to move my company's banking elsewhere. I could understand requiring a third factor to authenticate if signing in from a different location or a different ISP than I've been using for the past 5 years, but it's ridiculous to do so if nothing has changed (except the final octet of my DHCP-assigned address) since I last signed in yesterday. I use a different computer (via SSH) to read my email than I do for web browsing, and cutting-and-pasting a signin link that's hundreds of characters long (spanning multiple lines in Emacs, so I have to manually remove \ where it crosses line boundaries) is a PITA. Adding friction on every sign-in colors all subsequent interactions I have with an app, and makes me hate using it.
  • MaxGabriel 2y ago
    I’m the CTO of Mercury You shouldn’t get the device verification requirement if you’ve used the device before (we store a permanent cookie to check this) or for the same IP. Any chance your cookies are being cleared regularly? We added this after attackers created clones of http://mercury.com http://mercury.com and took out Google ads for it. When customers entered their password and TOTP on the phishing site, the phisher would use their credentials to login and create virtual cards and buy crypto/gold/etc. The phisher would also redirect the user to the real Mercury and hope they figured it was a blip. This device verification link we send authorizes the IP/device you open it on, which has almost entirely defeated the phishers. Since WebAuthn is immune to this style of phishing attack, we don’t require device verification if you use it. I highly recommend using TouchID/FaceID or your device’s flavor of WebAuthn if you can—it’s more convenient and more secure. You can add it here: https://app.mercury.com/settings/security https://app.mercury.com/settings/security That said, we are talking internally about your post and we do recognize that as IPv6 gets more traction IPs will rotate much more regularly, so we’ll think if we should loosen restrictions on being a same-IP match.
    • deleted 2y ago
      [deleted]
• o999 2y ago
  Most internet users (who aren't tech savvy and will never be) will find magic link || mailed OTP way easier than passkeys accross devices, etc..
• deleted 2y ago
  [deleted]
• lxe 2y ago
  > I don’t have my email on my gaming PC, nor do I have it on my work laptops. What? You have your email on literally every device -- be honest.
  • dgrove 2y ago
    Just because you make exceptions doesn't mean everyone else does
  • mrweasel 2y ago
    Nope, I don't have email on my phone. This breaks magic links all the time for me. In many situations I wouldn't even be able to configure my phone to show me my email, because I don't know the password, it's in my password manager and is lke 52 random characters. I think it's interesting that the author has chosen to not have email on PCs, but I can see why. I also completely get why they'd opt to not have private email on a work laptop.
  • gepeto42 2y ago
    I don't have my home email on work devices. I also don't have my email on my gaming PC (I agree this must be rarer). I don't have all of my work emails on my personal devices either. So now when I log in I need to DM myself links over Slack, or forward emails around...
• dandigangi 2y ago
  Been saying this for a bit now. OTP/magic links have some upsides but the second your SMS or email provider doesn't deliver said thing your users are in trouble.
• n144q 2y ago
  My data point as an edge case: on a certain website, I have a throwaway account registered with a throwaway gmail account. I don't use that gmail account for anything else, and in order not to affect my regular Gmail login, I use incognito window. Now, whenever I need to log in to the website on a new device, I have to also login gmail as well (since the login credentials are never kept between sessions). This has been very annoying, and would not happen with password with 2FA.
• sieabahlpark 2y ago
  [dead]
• sergiotapia 2y ago
  Just use email and password, companies. Please. I have a password manager, I will stop using your service if it's a pain to login. Even something small thing like email -> hit enter -> then we show password input, will cause me to stop using your service.
• ivanjermakov 2y ago
  I was surprised to learn how many people never save passwords and just reset it via email whenever they need to log in.
• paxys 2y ago
  I'm okay with magic links IF the website using it doesn't invalidate my session for no reason after some random period. If I have to do the email song and dance every week I'm very likely to eventually not bother with the product (looking at you Claude).
• lyime 2y ago
  I don't like magic links but OTP code via email or sms has preferable set of trade-offs.
• FriedPickles 2y ago
  Calling these links 'magic' is an insult to magicians who spent years mastering actual sorcery. We're just passing around URL-encoded tokens.
• Halian 2y ago
  I *hate* magic links. Just let me use a damn password.
• theltrj 2y ago
  Thank you for writing this! Getting users to implicitly trust clicking a link as a login mechanism....what could possibly go wrong?
• vanillaicesquad 2y ago
  [dead]
• shoelessone 2y ago
  I completely agree. I find magic links much more of a hassle than a password.
• tonymet 2y ago
  Or the involuntary option. Here is an example from Lowes 1. enter username 2. choose password or magic link (select password) 3. enter password properly 4. Thank you for logging in. Please click your magic link to log in. Why did you waste my time putting in a password when the magic link was the only option?
• perryizgr8 2y ago
  I once had an app send me a code in the email. But if I opened my email app to check the code, and then return to the app to enter it, it would lose context! It would ask me to enter my email again, and proceeded to send a new code. There was no way to log in using only my phone.
• shark_laser 2y ago
  Nostr Login using NIP07 is amazing. There's even cooler ways that are already working including nsec bunkers. This is the way of the future IMHO, most people just don't know it yet.
• gregates 2y ago
  I suspect a hidden "benefit" to the companies implementing this is that it makes it much harder to share your account. You are probably happy to share your Netflix password with your mom, but not your email password. They can present it as a "more secure" login method, obscuring the reason they actually like it.
  • pcchristie 2y ago
    I'm pretty sure Medium (who was the first implementation of this that I know of) uses it as a way of blocking pay wall bypassers (which on Medium I think manipulated/deleted cookies to get around the 3 article limit).
  • gepeto42 2y ago
    Yeah that would not surprise me, in general. I don't think that would be 404's goal, since they provide full-text RSS feeds I could share with a friend easily, but I could see that happening with other services.
• rednafi 2y ago
  Username and password combo works. All these ceremonies around OAuth, passkeys, and magic links solved one problem but introduced two more. My job as a service provider isn’t to coddle people who can’t be bothered to use a password manager. Auth is the worst part of building a service and sucks all the fun out of it. API auth is a mess because people can’t keep a token string secret. Now we need JWTs, OAuth, token refreshing, and a whole bunch of BS that no one enjoys. One reason why OpenAI and Anthropic APIs are so much more fun to use than Google and AWS offerings is that you get a token and are responsible for keeping it safe. It makes the entire workflow dead simple. I’m not creating a new project or fiddling with IAM just to try out an endpoint.
  • tptacek 2y ago
    Your job as a service provider is, in fact, to minimize the likelihood that you will manage to communicate the passwords of your users to outsiders, because those passwords are very likely to be shared. That passwords should not be shared doesn't reduce your responsibility.
• jerieljan 2y ago
  Every time I see magic links, I always think: "I thought we weren't supposed to click links in emails in the first place?". When links in email come into mind, so does phishing. I hate these magic links a lot.
  • crazygringo 2y ago
    Is anyone confused by that? Password reset links have always been sent to email. The point is not to click suspicious links. If you know a magic link was sent, it's not suspicious. That being said, I hate them just for the delay.
    • efreak 2y ago
      Be careful of those as well, but in this case it's quite simple: password reset links should only be sent when the user explicitly requests them; of you receive an unexpected email asking you to reset your password, don't click the link.
    • SV_BubbleTime 2y ago
      Ok. So now my users get random login links for sites we may or may not use… sure, you Silicon Valley Cool Guy aren’t going to fall for it, but my blue collar Detroit UAW guys might. Click that stupid magic link for a service we use, and they’re asked for their Office 365 credentials… all the while I’m telling them not to click links in emails.
    • adastra22 2y ago
      I don't like password reset links either. Send me a code I can type in, but only to the original browser session.
    • tylersmith 2y ago
      Nobody is actually confused, it's just performative whining.
    • gepeto42 2y ago
      As someone in the security industry, I find it amazing how much we've told people (in awareness training) to "not click things on the thing-clicking machine™" while simultaneously having processes like password resets that require doing it. ™Kelly Shortridge 2021 (https://x.com/swagitda_/status/1503751776134180873 https://x.com/swagitda_/status/1503751776134180873)
• muppetman 2y ago
  Magic link are so, so stupid. Sure, make it an option for Grandma, but don't trot them out like they're amazing, they're terrible. God I hate the way the Internet is going - idiots making technical decisions.
  • dmattia 2y ago
    They are sometimes required. Say you are on a mailing list for some company you gave your email to at some checkout counter one time, and you want to unsubscribe. You probably don't have an actual account with a login with that retailer, they just have your email address. In this case, what alternative is there than having a magic link in the footer of that email that says "unsubscribe" that includes a token unique to that email address that acts as proof of owning an email account when you then click that link and ask to unsubscribe?
    • ale42 2y ago
      There are many options where such links are a reasonable option. I'm okay to receive such a link to validate my e-mail for an account creation, or to unsubscribe from a mailing list at a place I don't have an account at, or to display an order status page at a shop where I ordered as a guest without creating an accoung. But using them as the only option to login is really, really annoying. Mails can get trapped in spam filters, delayed by intermediate server overload or spam filters that sometimes take 10 minutes, servers doing graylisting... Plus all the other annoyances listed in the article (e.g. multi-device users, in-app browsers). At the very least, support passkeys if you really don't want to store (hashed) passwords. And no, SMS is not an alternative: I was several times barred from logging in to a service because SMS wasn't properly working (can happen easily while roaming abroad).
    • deleted 2y ago
      [deleted]
    • muppetman 2y ago
      Yes, sorry. I mean in the same way as the other person who's replied to you. Don't give me an "account" somewhere I'm expected to use on a regular basis but require me to use magic links.
• mediumsmart 2y ago
  What a good idea to get people used to clicking on a link in an email to login. Magic opportunities.
• albert_e 2y ago
  Fun domain name. Unfortunately blocked on my (work) network -- classified as miscellaneous / unknown category.
  • gepeto42 2y ago
    I have to admit I bought it mostly to annoy a few very specific friends, but then I kept using it. I would not recommend trying to host anything serious on such a TLD. If you check the early comments on the thread I posted the full content for someone else who could not reach .zip domains.
• ahmedhanks 2y ago
  No issues for me.
• SV_BubbleTime 2y ago
  Expensify. We dumped them for a host of reasons, but included in there was their use of tragic link logins. Absolute clowns. Glad to see this practice getting the negative attention it deserves.
• deleted 2y ago
  [deleted]
• adastra22 2y ago
  I refuse to use any service that only supports magic links for auth. It is incredibly user-hostile, and absolutely worse from a security perspective than passwords (with a password manager). Most critically it simply does not work in my personal setup where I do not have access to my email account from the machine I am using to login, precisely for security reasons and the safety of my accounts. Anthropic has been the once exception to this personal policy simply because Claude is the best LLM out there. But it's a mountain of pain every time I have to re-login, and I've complained to them multiple times about this.
  • apitman 2y ago
    Sadly not enough people use password managers for it to be worth it for companies to target those flows.
    • adastra22 2y ago
      60% of Internet users rely on a password manager, and that number is still growing by a significant amount each year.
      • apitman 2y ago
        A quick search is indicating more like 30%, which honestly is way higher than I expected. Where are you seeing 60%?
        • adastra22 2y ago
          It is ~30% for personal use, and ~60% when you include personal + work. So 30% use it in both contexts, and an additional 30% just for work. A combined 60% use password managers in some capacity in their work or personal lives.
          • apitman 2y ago
            Cool, thanks. Do you have a link to these stats?
• _tom_ 2y ago
  Yeah, and everyone who did not flunk security training knows not to click on the links. Don't send me a link, tell me where to find it, after I log in.
• doener 2y ago
  Oh I hate how Slack uses this. Because if extensive use of magic links I lost track about my two accounts and several spaces.
• Terr_ 2y ago
  > Of course, as stated in the article, such email links are harder to phish than passwords On the other hand, training users to expect and use hard-to-read login-links in emails is not really good either. It promotes a broad range of scams, phishing, and potential malicious code exploits, even if the a particular sender's site has been hardened somehow. (e.g. a TOTP app on a phone.)
• sebastiennight 2y ago
  We've been using Magic Links for a few years (and yes, one reason was to avoid the security issue of storing user passwords when we were just at MVP stage) and found the top problems with it are: 1. Some users (0.1%) just don't ever get the email. We tried sending from our IP, sending from MailGun, sending from PostMark, having a multi-tier retry from different transactional tools. Still, some people just will not ever be able to log in. 2. People click old Magic Links and get frustrated when a 6-month old link "doesn't work". We've decided to remedy that by showing them a page that re-sends the link and explains the situation (like Docusign does) instead of an error message. 3. People will routinely mis-spell their email and then blame the system when they don't get the code. All of this still results, I feel, in way fewer support tickets than the email+password paradigm, so I'm still in favor of Magic links.
  • cchance 2y ago
    Funny part is most of those apply to passwords too, using an old password and complaining its not working, mistyping shit and complaining that its the system, and requesting a password reset and not getting the mail LOL so i only see upsides
  • tjoff 2y ago
    ... but the usability is a nightmare.
    • graemep 2y ago
      Absolutely. Users have to wait for the email before signing in, it does not work on devices without email without copying the link, etc.
  • 255kb 2y ago
    It's indeed interesting the number of people misspelling their email address, or having an inbox so full that it cannot receive emails anymore. I never tried to add magix links, but I added Google Sign in to my SaaS several month ago, and since then, it accounts for more than 90% of new sign-ups (users are devs, so rather tech savvy and privacy aware). I'm now convinced that no other method is a priority (I still have email/password of course).
• Helmut10001 2y ago
  Revolut [1] does this and while I like their service overall, I hate the login mails. My email box is full of these login mails and it feels like abuse of the email system to me. I have all kinds of alternatives, Yubikey, TOTP, Password Manager etc. - everything would be better than this magic login link. [1]: https://www.revolut.com https://www.revolut.com
  • usr1106 2y ago
    So in case of temporary email delivery problem no banking? I had this case recently: Sending a job application, so wanting to check what my LinkedIn actually says (I don't use or even update LinkedIn regularly). Now LinkedIn thinks my login looks suspicious and sends a confirmation email. (It does that nearly every time the rare cases I log in, probably because I delete cookies.) But the mail doesn't arrive. My email provider is usually very reliable, but later I learned that just in this moment they experienced multi-hour delays. While this was not a magic link it shows that any login requiring a quick email delivery can fail in the worst moment.
• jackthemuss 2y ago
  It’s hard to do right. I made mailslurp for this reason to allow end to end testing of magic link flows using disposable email accounts.
• justin_ 2y ago
  Related thread from September 2024: The "email is authentication" pattern https://news.ycombinator.com/item?id=41475218 Some users use email flows, such as "magic links", instead of bothering with passwords at all.
• Jean-Papoulos 2y ago
  Most users do live with a single device. If they have a work computer, they also have a work email (the client of which is unfortunately probably already opened for other reason when they want to login to the site). The most-devices people I know are those who have a laptop, phone and tablet. That's it, I literally cannot think of anyone I know with more then this, and most of those with tablets are using it for games or reading or for the kids. Magic links are indeed the best solution for the average user. Type in your email with autocomplete, get a notification from the mailbox, click, click, and you're in.
  • wpm 2y ago
    “Type in your email with autocomplete, get a notification from the mailbox, click, click, and you're in.” My autocomplete can fill a password or passkey in too. Don’t waste my time.
• zyn1643158 2y ago
  [dead]
• timvisee 2y ago
  I do have a good use case for magic links. I creates a bar management/sales platform for our group of friends. It's self service so people purchase their products on their phone and pay later. People get... intoxicated... after which passwords appear to become quite the problem. Magic links solved that. To solve the multi device and in-app browser problem people can also open the links on another device. That'll show a short code they can enter on the original device to actually log in. It's not perfect, but it works. I do fully agree that passwords should always be an option as well.
• anotheryou 2y ago
  get Mail on different device, copy link and send it to myself via some messenger, link preview uses up the login %)
• pwdisswordfishz 2y ago
  > Anti-mobile. As mentioned by 404 in their own article, this breaks the ability to use in-app browsers, which is quite annoying especially for RSS reader type apps. It makes interacting with any local link in the RSS feed extremely annoying. To be fair, in-app browsers should die, especially those without an "open in regular browser" opt-out – which RSS readers should readily offer anyway.
  • pcthrowaway 2y ago
    Seriously, this needs to be ended by the harshest penalty of law. Throw every product manager responsible for forcing in-app browsers upon their users in jail.
  • hackernewds 2y ago
    What is an RSS reader?
    • tzs 2y ago
      An RSS reader is the client software for reading RSS feeds. Here's a description of RSS feeds [1]. Here is a list of some readers [2]. [1] https://en.wikipedia.org/wiki/RSS https://en.wikipedia.org/wiki/RSS [2] https://en.wikipedia.org/wiki/Comparison_of_feed_aggregators https://en.wikipedia.org/wiki/Comparison_of_feed_aggregators
• victorbjorklund 2y ago
  I really hate magic links. Only time I think they could be acceptable is if it is an app where you just log in once or maybe once every couple of years.
• Saris 2y ago
  Magic links are one of the worst things ever introduced on the internet. They're slow, painful, and just such a dumb idea.
• buro9 2y ago
  The article doesn't even touch "people enter their email incorrectly when registering an account". I've received magic links to my Gmail account that belong to other people, for accounts that have ordered flight tickets, or clothing, or digital services. Those people, I guess they now have no way to access their online account, as they cannot password reset (if that was the fallback), or change their email (usually requiring confirmation), or receive their magic link. There's nothing I can do here, except to delete the email, I don't have any indication as to what the correct email should be, and the person's name is the same as my legal name and there are a lot of people with that name in the World. Few services verify an email during sign-up, because I'm sure data shows that added friction during sign-up results in fewer people signing up.
  • denismi 2y ago
    This happens on my Gmail all the time. Frankly, if somebody else uses my address for a service and I'm receiving anything other than email verification from that service, I'm reporting it as spam on both Gmail and Fastmail because that's what it is.
  • gepeto42 2y ago
    You're right, I forgot to even cover that part because I was focused on how annoying they are to me as a user, not necessarily as a service provider. I also forgot to mention how they train people to click on links, how my inbox now consists of dozens of emails per day telling me to either click to login, or warning me that I logged in. I have my own domains for email so I haven't had the issue of someone else entering my email but I keep hearing from friends getting that.
• m4tthumphrey 2y ago
  Good post. I chose to only implement magic links in a previous project and had an issue with users complaining that the (one-time) link would always be expired when they clicked. I could not reproduce it and just left it. Then this thread appeared and I instantly knew the problem: email client previews. Lesson learnt.
• jvanderbot 2y ago
  I have a very personal reason to hate magic links: I'm quite fast at passwords and 2fa. The whole thing is second nature, I have a password scheme to deduce the password for any site but keep them long and high entropy, and I can do 2fa calculations from any trusted device without taking my hands off the keyboard (thanks to oathtool), and anyway my passwords are sync'd securely and I can look them up with hands on keyboard. This is strictly better than "single point of email failure". Why force me to be less secure and less usable. Please, just allow me to use passwords and regular old TOTP.
• littlestymaar 2y ago
  While I agree with most he says, I really don't get why people would push for passkeys like this, it's probably the worse system in existence in terms of UX (as the more likely to get you locked-out of your account) while providing minimal security benefits (the account recovery mechanism is the weakest link in the chain, and as such it's not any better than magic links). The only ones benefiting from passkeys are Google and Apple (and app/website owners who can't avoid mismanaging user passwords, but they have little stake in this game anyway).
• methou 2y ago
  I hate those tragic links, some of them were sent from third party and infested with tracking links. Worse, it looks like from the site I'm logging in to, but the href is a tracker with redirection to the actual link. I see this frequently because my dns blocks those trackers.
• openplatypus 2y ago
  404Media article about Magic Links: https://www.404media.co/we-dont-want-your-password-3/ https://www.404media.co/we-dont-want-your-password-3/ Our response to above: https://wideangle.co/blog/passwordless-authentication-magic-links https://wideangle.co/blog/passwordless-authentication-magic-... Conclusions: Magic Links good? Yes. Magic Links the best? No.
• WaitWaitWha 2y ago
  Just a pet peeve with passkeys (and other authN) that presses users towards biometrics - In the US, because the Fifth Amendment Self-Incrimination Clause, passwords cannot be demanded. Passwords are testimonial evidence. [United States v. Hubbell (2000); re Grand Jury Subpoena Duces Tecum (11th Cir. 2012)] Biometrics on the other hand are not. The court ruled that a defendant could be compelled to unlock a phone with biometrics because it is not testimonial. [Commonwealth v. Baust (Virginia, 2014); State v. Diamond (Minnesota, 2017)] Basically, passwords cannot be compelled to be disclosed, while biometrics can. There is similar legal stance in Canada, UK, Australia, India, Germany, and Brazil to name a few. Finally, under duress, passwords can be held, while biometrics cannot, without self harm.
  • gepeto42 2y ago
    What I'd recommend is if you're worried about this (or worried about it in certain instances), disable biometrics to unlock the device itself. Then, passkeys on it don't really matter anymore.
    • WaitWaitWha 2y ago
      This works if the event, which forces unlock, is expected. Often such events are not expected and there are but seconds.
      • OKRainbowKid 2y ago
        On my android phone, if I hold the power button I get the option to "lockdown", which immediately locks the phone and disables biometrics for the next unlock, requiring the PIN/password. I assume that would work for the situations you have in mind.
        • jesseendahl 2y ago
          Yup and iPhone has the same feature. Seems like parent may not be aware of this.
      • 2y ago
• Kwpolska 2y ago
  I agree with magic links being bad, but passkeys aren't the right solution for multiple devices either, because it requires sharing the account or password manager they're saved in between devices, and I'd rather keep my private accounts and passwords away from work devices. With plain old passwords, I can open my password manager on a trusted device and type the password into an untrusted one.
• cratermoon 2y ago
  From a .zip domain. Irony.
  • gepeto42 2y ago
    Thanks for recognizing it, it was absolutely by design!
• shortformblog 2y ago
  Feel like the solution to this problem is probably to offer an app that turns magic links into notifications. As well as to probably untether the magic link from the cookie in the browser, so that you are not required to hit the magic link in the same browser that you called the link from.
• albert_e 2y ago
  Virtually all online streaming services in India now use a OTP sent to registered mobile number as the way to login to the app on any device. Magic links and OTPs have become common for many other sites I use -- Udemy, Teachable etc. come to mind. Recently I bought a cheap "smart watch" for my kid. Mostly for the digital display with configurable clock faces and simple step counting. The app would refuse to activate the watch unless we provide a valid mobile number and OTP. Why the hell do I need to give them a working mobile number just to use a smartwatch. Even if I wanted (which I did not) to get notifications / calls / texts / caller ID / contacts from my paired smartphone ... the smartwatch app does not need to know my phone number for that functionality to work. Feel so powerless.
• chrisweekly 2y ago
  I hate magic links. Being forced to switch applications to wait and hope an email will eventually arrive is a fundamentally bad experience.