Hacker News Reader

Comment by chx | Hacker News Reader

Here's my advice: do not use passwords. Just don't. If someone wants to log in, mail them a one time link. And make the session long enough this doesn't happen often -- when was the last time you needed to log into HN or Github?

We also AES encrypt the emails with the key stored on a network share. It doesn't add a lot of complexity and if an attacker gets hold of the contents of the database, they still don't have this piece of PII. It's by no means a big hurdle against any serious attack but it's nice to have.

View on HN

Edit: This is a decent enough solution, though it comes with its own pitfalls.

How exactly are you sure that the email is encrypted and is read only by the intended receiver and not by anyone else? This is too simplistic as a solution. Things like what to do if a user clicks on the same link more than once also have to be considered (is it really the intended user who clicked it or a malicious actor that the user is not aware of?).

> How exactly are you sure that the email is encrypted and is read only by the intended receiver and not by anyone else?

Same way you make sure that the password reset links sent to your email are only received by you and not by anyone else?

This! It's like everyone has already implemented email based login (password resets) but chooses more complexity by adding a password.

I wish every site did this. Especially for non technical users, passwords are such a mental barrier.

Another big one is that this method is not entirely device agnostic. I am not able/willing to log into my email account on every device that I might want to log into your service with.

One way this has been prevented for me so far is to include a one time pass in the mail along with the link, but some people might still not have a second device on hand every time they want to log in.

now.sh handles this quite nicely: when you log in there, they send you an email and display three random words. When you get the email, you verify the words match, click the link, and then you'll be logged in in the original browser tab, on the original device.

And how do I log into my email account to access this one time link?

Edit: Even if it's an account held on a private server, there must be a password, must there not?

Theoretically you could use x.509 certs and a key stored on a smartcard type device, but sure.

Point is, this advice is probably aimed at developers who aren't working on email systems.

Provisioning and maintaining the certificates/keys across even a small user base is a huge pain compared to letting users choose their own passwords.

Hence theoretically. :)

Reply on news.ycombinator.com