4 ms·

Why not just support a password?

by adastra22 2y ago

ThePowerOfFuet 2y ago
Because ≈everyone reuses passwords and so accounts get taken over.
- sam_lowry_ 2y ago
  So what?
  - victorbjorklund 2y ago
    1) It means your users will complain that their account was hacked (even if it was their fault) and might cancel their service 2) hackers can exploit your system which hurts you (you are a VPS provider and someone mines crypto and you have to wave it for PR) or you run an email service and someone uses your app to spam (which hurts your email rep) etc.
- adastra22 2y ago
  A majority of internet users (>60% in 2024 and growing) use password managers and don’t reuse passwords.
  - deleted 2y ago
    [deleted]
  - wccrawford 2y ago
    https://www.security.org/digital-safety/password-manager-annual-report/ https://www.security.org/digital-safety/password-manager-ann... 36%.
  - JW_00000 2y ago
    Do you have a source for that number? 60% seems extremely high based on non-technies I know.
    - mooreds 2y ago
      Agreed. I'd be thrilled if it were true, though! Because password reuse (esp without MFA) is a big problem.
  - ctxc 2y ago
    I'm surprised. >60% seems high even for tech literate software engineers!
  - sebastiennight 2y ago
    This is an extraordinary claim on two counts: 1. Sixty percent seems astronomically high, do you have a source? and 2. Most "normal" non-tech-savvy people I know who do use a password manager (which I've typically installed for them), are revealed a while later to still use a variation of password reuse : either storing the same password per category of websites, or having a password template they use on all sites, e.g. "IdenticalSecretWord_SiteName"
    - lkbm 2y ago
      I don't have the source, but don't think 1Password/LastPass/KeePass. Think the "would you like to save this login" built in to Chrome, Firefox, Edge, Windows, and iOS. These days, you have to opt-out of password management.
    - schnable 2y ago
      Right, use of a Password Manager does not imply they are using Password generation - it may just mean they click "Save this password" after logging in using a re-used password.
  - dspillett 2y ago
    In my experience 60% seems too high even for supposedly technical users (ref: I work in a dev firm), at least away from their jobs. I definitely don't believe it for the wiser population (my gut, again based on people I know, says the number is more like 10%, maybe 15). Even the 36% figure on the report on security.org posted above seems dubious, I suspect they have some bias in their survey. Unless that is some people who use the iCloud password manager for some things and no password manager for everything else, so it isn't claiming 36% routinely use a password manager away from a few key accounts.
matt-p 2y ago
Only having magic links gets you a load of stuff for free, Higher level of security than just user+pass (w/ forgot password) Email verification Lifecycle management - in a SAAS when a user no longer has a corporate email, they can defacto not log in, wheras with a user+pass you need to remember to remove their account manually on each SAAS or have integration with your AD (for example)
- nimish 2y ago
  It's incredibly annoying to the user though
- adastra22 2y ago
  It’s not a higher level of security than password-based authentication. Why do you state that? One-time email verification is not the same as security model as magic links. Magic links require instant access. Many security sensitive sites require a time delay and secondary notification for password reset links, which you can’t reasonably do for login links. Lifecycle management is an interesting point. There are some underlying assumptions that might not hold though—losing an email doesn’t necessarily mean downstream accounts should be auto disabled too. Think Facebook and college emails, for example.
  - mooreds 2y ago
    > It’s not a higher level of security than password-based authentication. Why do you state that? It could be, depending on how the user has secured their email inbox access. I know I pay a lot more attention to my inbox than some random account. I don't have data, but I think this is true of most people. I'm also more likely to enable MFA on my email account than I will on every random account I sign up for. And as far as the account providers, I trust the big email providers to be more secure than some random website with an unknown level of security. You raise some valid points about tying access to a third party and what makes sense. It's not a simple issue.
  - michaelt 2y ago
    > It’s not a higher level of security than password-based authentication. Why do you state that? Personally I'm no fan of magic links. But the people who do like magic links would say the typical 'forgot password' flow is to send a password reset magic link by e-mail. That means you've got all the security weaknesses of a magic link, and the added weaknesses of password reuse and weak passwords. Of course you can certainly design a system where this isn't the case. Banks that send your password reset code by physical mail. Shopping websites where resetting your password deletes your stored credit card details. Things like that.
davidmurdoch 2y ago
One weird reason I've personal run into: when building on the edge, like with cloudflare workers, you can run into timeout issues because of how long password hashing takes.
- kentonv 2y ago
  That should be only if you're on the free plan that has a 10ms time limit. Paid plan gets 30 whole seconds which is plenty of time to hash lots of passwords.
mooreds 2y ago
Oh, we support passwords! (And passkeys, and social login, and OIDC, and SAML.) Just want to make sure magic links work as well as they can. Different folks have different requirements, and since we're a devtool, we try to meet folks where they are at. We actually recently added a feature which lets you examine the results of a login, including how the user authenticated, and deny access if they didn't use an approved method.

Why not just support a password?

ThePowerOfFuet 2y ago

Because ≈everyone reuses passwords and so accounts get taken over.

sam_lowry_ 2y ago
So what?
- victorbjorklund 2y ago
  1) It means your users will complain that their account was hacked (even if it was their fault) and might cancel their service 2) hackers can exploit your system which hurts you (you are a VPS provider and someone mines crypto and you have to wave it for PR) or you run an email service and someone uses your app to spam (which hurts your email rep) etc.
adastra22 2y ago
A majority of internet users (>60% in 2024 and growing) use password managers and don’t reuse passwords.
- deleted 2y ago
  [deleted]
- wccrawford 2y ago
  https://www.security.org/digital-safety/password-manager-annual-report/ https://www.security.org/digital-safety/password-manager-ann... 36%.
- JW_00000 2y ago
  Do you have a source for that number? 60% seems extremely high based on non-technies I know.
  - mooreds 2y ago
    Agreed. I'd be thrilled if it were true, though! Because password reuse (esp without MFA) is a big problem.
- ctxc 2y ago
  I'm surprised. >60% seems high even for tech literate software engineers!
- sebastiennight 2y ago
  This is an extraordinary claim on two counts: 1. Sixty percent seems astronomically high, do you have a source? and 2. Most "normal" non-tech-savvy people I know who do use a password manager (which I've typically installed for them), are revealed a while later to still use a variation of password reuse : either storing the same password per category of websites, or having a password template they use on all sites, e.g. "IdenticalSecretWord_SiteName"
  - lkbm 2y ago
    I don't have the source, but don't think 1Password/LastPass/KeePass. Think the "would you like to save this login" built in to Chrome, Firefox, Edge, Windows, and iOS. These days, you have to opt-out of password management.
  - schnable 2y ago
    Right, use of a Password Manager does not imply they are using Password generation - it may just mean they click "Save this password" after logging in using a re-used password.
- dspillett 2y ago
  In my experience 60% seems too high even for supposedly technical users (ref: I work in a dev firm), at least away from their jobs. I definitely don't believe it for the wiser population (my gut, again based on people I know, says the number is more like 10%, maybe 15). Even the 36% figure on the report on security.org posted above seems dubious, I suspect they have some bias in their survey. Unless that is some people who use the iCloud password manager for some things and no password manager for everything else, so it isn't claiming 36% routinely use a password manager away from a few key accounts.

matt-p 2y ago

Only having magic links gets you a load of stuff for free, Higher level of security than just user+pass (w/ forgot password) Email verification Lifecycle management - in a SAAS when a user no longer has a corporate email, they can defacto not log in, wheras with a user+pass you need to remember to remove their account manually on each SAAS or have integration with your AD (for example)

nimish 2y ago
It's incredibly annoying to the user though
adastra22 2y ago
It’s not a higher level of security than password-based authentication. Why do you state that? One-time email verification is not the same as security model as magic links. Magic links require instant access. Many security sensitive sites require a time delay and secondary notification for password reset links, which you can’t reasonably do for login links. Lifecycle management is an interesting point. There are some underlying assumptions that might not hold though—losing an email doesn’t necessarily mean downstream accounts should be auto disabled too. Think Facebook and college emails, for example.
- mooreds 2y ago
  > It’s not a higher level of security than password-based authentication. Why do you state that? It could be, depending on how the user has secured their email inbox access. I know I pay a lot more attention to my inbox than some random account. I don't have data, but I think this is true of most people. I'm also more likely to enable MFA on my email account than I will on every random account I sign up for. And as far as the account providers, I trust the big email providers to be more secure than some random website with an unknown level of security. You raise some valid points about tying access to a third party and what makes sense. It's not a simple issue.
- michaelt 2y ago
  > It’s not a higher level of security than password-based authentication. Why do you state that? Personally I'm no fan of magic links. But the people who do like magic links would say the typical 'forgot password' flow is to send a password reset magic link by e-mail. That means you've got all the security weaknesses of a magic link, and the added weaknesses of password reuse and weak passwords. Of course you can certainly design a system where this isn't the case. Banks that send your password reset code by physical mail. Shopping websites where resetting your password deletes your stored credit card details. Things like that.

davidmurdoch 2y ago

One weird reason I've personal run into: when building on the edge, like with cloudflare workers, you can run into timeout issues because of how long password hashing takes.

kentonv 2y ago
That should be only if you're on the free plan that has a 10ms time limit. Paid plan gets 30 whole seconds which is plenty of time to hash lots of passwords.

mooreds 2y ago

Oh, we support passwords! (And passkeys, and social login, and OIDC, and SAML.) Just want to make sure magic links work as well as they can. Different folks have different requirements, and since we're a devtool, we try to meet folks where they are at. We actually recently added a feature which lets you examine the results of a login, including how the user authenticated, and deny access if they didn't use an approved method.