Hacker News Reader

Comment by kaycebasques | Hacker News Reader

For my little side project I’m using email only.

Tangentially related, I quite like Medium’s workflow where you don’t need to enter passwords anymore. You just enter your address, they send a login email, you click the link in your email, and it redirects you to Medium, logged in.

View on HN

You don't need to enter passwords because you are stuck in a password reset groundhog day scenario. You want to login to Medium yet you need to access your emails first, it makes very little sense actually.

> it makes very little sense actually

It's actually one of the safest ways to offer email authentication.

Recall that the email requires some way to login, which is probably a password anyway. What do you gain in terms of security (rather than simplicity) by shifting responsibility onto the email provider?

Most email providers already implement (and with very large user bases which provide testing) all the features you'd have to implement yourself for proper security, like 2fa, password encryption, password reset workflows. To implement all that yourself, highly likely you will not do it as robustly as another provider. Also very costly in time.

I’m working on a side project that does this too, thought I was the only one.

Whenever I see a regular user of any other service have to reset their password to login in anyway, I’m like man this password thing is kind of not that useful

For real critical cases, I think a major issue might be plaintext SMTP.

I don't know percentages, but it does seem like most major SMTP servers support opportunistic TLS, so your messages are at least encrypted over the wire.

Interesting, I always assumed this would be too much hassle for users since after the first login, the browser (mobile or desktop) would remember the password.

Certainly seems like an optimum solution to typing a password on first login though (assuming the email is prompt).

Couple of points, first of all the thing the browser can still remember is the auth token in a non-expiring cookie. As the majority of users will rarely if ever clear cookies or change browsers, this nullifies the password remembering feature.

Secondly, particularly on mobile, tapping through to email and hitting a link is probably faster and more convenient for most users than simply entering a password on the keyboard.

It's just a shame it's such a pain to write automated tests that go through the email login procedure compared to username/password ;-)

I used a fundraising tool recently with this kind of passwordless workflow. It's a tool that you only use once a year for about 30 days, and your authenticated session can last about that long. Which means you do the process once on each computer you use, and then you never have to remember the password the next year. It's great.

I like it too. No need for confirmation as you’re already accessing your email to login. It’s far more secure as the average user will most likely use the same password as the email to sign up with.

> Tangentially related, I quite like Medium’s workflow where you don’t need to enter passwords anymore. You just enter your address, they send a login email, you click the link in your email, and it redirects you to Medium, logged in.

That's absolutely crazy, I've always thought it didn't make any sense.

Browsers have autofill, and even if you don't want to use it it takes a lot less time to type your password than to click on a button, open your email client, wait for the email to arrive, click on a link, be taken back to the browser, yack!

It only make _kind_ of sense on mobile where typing is harder, but then again it's also a pain to switch to email and back.

Think about it from the perspective of the site owner. Much safer to offer access this way, and easier, than having to manage and store and secure passwords. Much safer for users.

I'm not convinced.

For the site owner, they can even more easily pick social login.

As for safety, it's just as hard for a hacker to guess my email password then my website password, what is the difference? Not to mention that if my phone is around you might be able to see the URL from the lock screen, and if God forbid my phone (or even laptop, but it never happens) is unlocked my email client is accessible at all times without a password).

But if someone can access your email, they can already reset your password anyway. So email is the Golden Gate to your services in general, regardless of whether you use this approach. And the URLs that are sent out would not just be simple things that you could look at and remember and then go type them into some other computer.

It comes down to ultimate safety for users and development time for vendors. I personally feel much safer knowing that some startup is not having to provide security on their own and store and manage my password and control all the things that my email provider does anyway. Because if that startup is hacked, there's much less likelihood of hackers walking away with credentials they can use later to access my account.

Social sign on offers similar reliability and development benefits. The difference is that in my experience a lot of people are quite hesitant to use a social service like facebook to sign onto a site that otherwise contains important personal data. But I do typically work with customers who are older, so they're less likely to understand these kinds of practices. A very common misconception that I've heard many many times is people who think that because you login with a Gmail or a Facebook OAuth, that means you're giving those companies access to your account on our app. Seems silly, but a very common misconception.

Whatever man, I think it sucks.

Insightful.

Reply on news.ycombinator.com