Hacker News Reader

Comment by trevyn | Hacker News Reader

For services that generally "stay logged in", why have passwords at all? Just do "magic login link" emails, with some sort of 2FA if you're into that.

View on HN

I think "magic login links" are fine for most services. Doing 2FA with that is not feasible though, unless you want to argue that receiving the email counts as "something you know" or that "something you have plus something else you have" counts as 2FA.

If you have your email protected with 2FA, I think you're covered -- "An unlocked device with an active session" is the thing you have.

I think this is actually what's happened -- people now know not to leave unlocked devices unattended, so you basically do 2FA every time you unlock your device, so the device can now stay persistently logged into all services.

I've considered using "magic login link" emails but greylisting[1] seems to be an insurmountable problem.

[1] https://en.wikipedia.org/wiki/Greylisting

Generally greylisting is supposed to let future emails through once it establishes that a server will re-send. It should be possible to detect greylisting and warn the user.

"Your email provider temporarily rejected our email to you. We will retry in a few minutes. If this happens persistently, please (check our guide for your provider, $MAJOR_PROVIDER|contact your provider) to figure out how to whitelist our login emails"

Isn't the former what Mozilla Persona was trying to provide? A shame that was canned.

We built a successor project under https://portier.github.io/. Alive and kicking :)

Reply on news.ycombinator.com