4 ms·
One of the biggest advantages of magic links is that they're unphishable while still being easy to use (unlike passkeys). Having a code completely negates that
by miki123211 2y ago
One of the biggest advantages of magic links is that they're unphishable while still being easy to use (unlike passkeys).
Having a code completely negates that advantage, as attackers can just set up a fake website that asks for the code.
Magic links should log you in on the device you click them, not on the device that requested the login session. Anything else, while being a little bit less annoying, is a security issue and should be treated as such.
- hombre_fatal 2y agoWhen using magic links, you can still support the common UX polish of letting a user log in on a different browser/device. If the user opens the magic link in the same browser that initiated the email, then just log them in. Otherwise, present them with the Apple-style "Do you want to authorize a login from 1.2.3.4 using Firefox on iOS possibly located in Portland, Maine? [Authorize] or [Reject]".
- tarxvf 2y agoThat would require I have my email on every device I might want to log in with. I don't like that for a number of reasons.
- hombre_fatal 2y agoThe conventional password system requires you to have a shared password manager on every device or that your reuse or memorize passwords. And that none of the service's users reuse passwords. It's all trade offs, else it would be easy.
- tarxvf 2y agoI can access my password manager on my trusted device, and manually type in my password for whatever service on any other device. This is exactly what I do for the rare but important time when I need to login on a device I don't want to have total access to everything.
- hombre_fatal 2y agoI see. Yeah, I pitch a scheme in a direct response to them where you can still let a magic link authenticate a session on another browser/device.
- miki123211 2y agoNot to mention passkeys, which people seem to be so enamored with.