Comment by zippergz | Hacker News Reader

Comment by zippergz | Hacker News Reader

From a usability standpoint, I feel that this just trades one set of issues for another.

Instead of having to remember a password, now I have to break my flow, go into my email client, and wait for an email to arrive. I have actually tried this flow with Slack's "Magic Sign-in Links." In my experience, it is not uncommon for it to take a few minutes for an email to arrive. In some cases, that could be enough to make me give up and move on. (I do appreciate Slack's approach to this -- you can choose to either use your email/password OR the emailed link). The thing is, the first usability problem (remembering passwords) is one that I can easily fix on my own if I so choose (either via a password manager or, heaven forbid, letting the browser remember it). The second (having to wait for an email) is totally out of my control.

That said, the one place where passwords are still a major hassle is in native mobile apps that don't integrate with a password manager. I still think that bouncing out to 1Password and copying/pasting my password is overall preferable to waiting for a link in email, but it's far from ideal.

Just make an app that automatically connects to your email, gets and parses the email (there can be a specific format) and asks "would you like to sign in to slack?" And you can just press "ok" and you'll get in. To make it even better, you can make it so that the email is signed by a pgp key you've previously trusted ("would you like to sign into trusted provider 'slack'?"), to make it resilient against phishing emails, and for extra protection the slack sign in page can show a random series of 6 digits, which is also emailed to you, so a phishing email wouldn't have access to those 6 digits; and you can compare those to what the app shows you.

i always like solutions that start with "just make an app". Especially if the problem is about convenience.

Ok, NSA... you're not fooling anyone.

Just?

Also, the only application that should have an actual access to your mail is your client.

Sure, it could hook into your email client. And it would be opensource. Wouldn't have to be complicated, could even be CLI.

I had been prepared to make a comment saying that the article's proposed flow is essentially the same as oAuth, except your email service acts as your identity provider and it is all manual.

But I have a feeling you may be facetiously getting at the same thing. Or are you?

you mean like some modification of OAuth?

Don't know about 1Password but bitwarden[0] has an auto-fill service for native apps which works great on Android in my experience. A simple slide down to open the notifications then two taps to select the details to use and it does the rest without having to leave the main application. Much faster than typing in my username and password.

[0]https://bitwarden.com

The only iOS app I can recall that integrates with 1Password is HipChat. Integration requires using AgileBits' extension (https://github.com/AgileBits/onepassword-app-extension). The password manager doesn't have any OS-level hooks that allow it to work with any app.

This is no longer true in iOS 11 (and may have been true in iOS 10). Programs may opt into showing “secure” share extensions in the same way that has been in Safari since share extensions were introduced.

I've been using bitwarden for a few months now, and it has totally supplanted LastPass in my workflow.

The only thing I miss is LastPass's form fill capability, but so far that's not been a huge barrier; trusting my browser to keep my credit card and address information handy and relatively safe isn't as convenient, but it's acceptable.

But this is really only needed sometimes. Most of the time you don’t need to log in at all. I’ve asked myself for years why not all sotes use this solution, it seems so obviously superior.

I think the zeit website, for nextjs, uses this. It was always a bit strange, imo. It seems to work as the blogger laid out.

Reply on news.ycombinator.com