5 ms·
3 isn't really possible, because the redirect needs to take you back to the browser session where you initiated the login from.
by paxys 2y ago
3 isn't really possible, because the redirect needs to take you back to the browser session where you initiated the login from.
- o999 2y agoNot necessarily, some services would have the magic link verify the session that triggered it regardless of browser or device. I assume it generates a session on the post-login screen and authorize that session upon accessing link
- ydant 2y agoThat has the problem of opening up an attack where the attacker requests the sign-in link, the person receiving the link blindly clicks it, and the attacker now has access. People blindly click links all the time. It would have a low success rate, but would be more than 0%.
- pests 2y agoI might receive a magic link on my phone but then sometimes I'll copy/paste that over to my desktop or another device. This works on 99% of magic links I've tried except for cases when they are trying to prevent account sharing. I remember the Bird bike app did this, where they required the magic link to be clicked on the same device login was initiated on. I was using my friends account and he would just forward me the link until one day this stopped working.
- duxup 2y agoIt seems like “prevent account sharing” and magic links are somewhat at odds by design.
- radlad 2y agoMore than a shared password?
- pests 2y agoThe idea being the user(s) would then have to share a email inbox to share logins, not just a password. It might not be the most inconvenient - this is partly how Netflix did their "Household" lockdown. You can request a travel code and this gets emailed to the primary email. I feel the way Netflix did this broke the social contract of profile sharing on purpose - before, if you were a good tenant, you could freeload off another paid account without inconveniencing them at all. Memes and jokes formed of still being on an ex-partner's account or how people would rename themselves "Settings". Getting an email and being harassed for the code by all those account sharers? Much more open and open for annoyingness.
- Groxx 2y agoIt definitely does not. Have your logging-in session wait for / poll "has visited magic link", and authenticate that session when it's done. Tons of systems do this. It works great, and it can quite easily work without any web browser at all on the logging-in side because it just needs to curl something -> poll for completion and save the cookies -> curl against the API. A number of oauth flows for e.g. TVs work this way, for instance, because it's a heck of a lot easier than integrating a full browser in the [embedded thing]. Many app-based 2FA (e.g. Duo) works this way too.
- renewiltord 2y agoSo I misclick a link in my email client and the evil guy who requested in is now logged in on his browser god knows where? Surely that can’t be real. It sounds awful. TVs involve copying a code to make sure the right device is being authenticated, or the ones I’ve used have at least.
- Groxx 2y agoDuo 2FA works the same way. In principle yes. And it's basically always accompanied by a "click this link" -> "are you trying to log in, and is this you? yes/no" page to resist that. Small code copying is also a very good answer though, yes. Roughly as easily manipulated, but nothing's perfect, and it's less "I didn't mean to click that button"-prone.
- renewiltord 2y agoYeah but I routinely click links in emails whereas logging in is the sole purpose of Duo. I could easily just intend to scroll the page and end up tapping the link.
- Groxx 2y agoso have that open a site that says "confirm login? y/n". I don't mean to imply that just visiting the link should be enough to complete a login. That's a GET and there's a LOT of issues with doing anything important on GET. Just "do something on a different machine, then automatically complete login on the one logging in", and magic links to trigger that flow are a rather straightforward option. There's no reason at all that it has to all occur on the same machine, and many reasons why attempting to require that doesn't work out in practice even when it does happen on the same machine.