Hacker News Reader

There are some minor issues with the magic link workflow - one of them is security scanning software potentially visiting the link.

So then you need to open the link in the same browser you want to use. But what if you want to log in on a desktop browser and only have your email on your phone?

Maybe have the magic link show a couple letters you need to type into the browser?

They are trivially solvable problems. PKCE and just displaying a QR code if you open it on the wrong device makes it pretty much foolproof.

e.g.: https://magic.cuvva.com/auth-callback?code=authzcode_000000B...

We're oriented around mobile use cases. Admittedly less ideal if you don't have your email on your desktop. But ultimately, if all else fails, you can always log into your webmail.

For me the key thing is that it doesn't rely on users having any particular knowledge or understanding best practices - they just need to hit the big green button. Sure people are more used to passwords, but that doesn't mean the usability of magic links isn't still better despite them being much less common.

Normal people are so bad at dealing with passwords. They reuse them, they forget them, they write them down on text files on their computer. Almost anything is better if your userbase isn't primarily technically adept people.

And frankly most popular email providers are pretty good at keeping the accounts secure. Likely much better than anything homegrown we could do. Especially given the fact that you'll just end up having password resets via email anyway.

> They reuse them, they forget them, they write them down on text files on their computer.

Writing them down in a textfile on the computer might not even be that bad _if_ they, as a consequence, are not or less reused.

The QR-code thingy hits a friction barrier. For me needing to go to my phone is more friction than unlocking my password manager. Note that I only need to unlock my password manager once per reboot, and that for most people the password manager is already too much friction.

You'd only use the QR code thing if you were logging into an app on your phone, but had opened the email on your laptop. It wouldn't make sense in the other direction.

Does this work for the case you have your email on your phone but you want to use the site on a computer? That seems more likely to me than the case that you have your email on your computer only, but it is neat to see that case addressed.

Yeah it's a fair point. The case I mentioned is for Cuvva, which currently is mobile-only.

Webmail is always a decent backup option though, so doesn't give me too much concern in terms of people getting stuck. But may be a little less seamless, particularly if they're using a shared/public computer. That scenario throws password managers out of the window too though.

> one of them is security scanning software potentially visiting the link.

I gave it some thought, and that seems to be solvable. Have the link go to a 'confirm' page, where the confirm button performs a post request. If security scanning software is randomly hitting post requests, that is just totally ridiculous.

What seems a lot more scary to me is the plaintext nature of e-mail. Even SMTP over TLS doesn't keep any end-points from reading your email, and I'm guessing there is a small but significant set of people who'se email providers don't run TLS.

Besides, if someone can recognize that any request is underway for a login, they might intercept it and send a phishing fake.

We've had "magic" links as the primary sign in method for our site for about a year now. It works well but we very regularly get requests to allow password login. So much so that we'll introduce that eventually.

Seems like both in combo could be a nice solution, but I'm sure we'll just start getting support requests from people whose password doesn't work because they never set one...

Interestingly, we replaced our login with magic links only over a year ago. We have roughly 1600-2000 active users, and as far as I know, we've never had anyone request a password login.

Not that I think about it.. it's kinda suspicious that no one has asked for it in all this time. Hmm..

Did you have issues with delayed email delivery (the user wants to login but the email is delayed because of some grey listing or some network glitch)?

No, we use Postmark which delivers very fast.

We use Mailgun which delivers quite fast, but we noticed that some customers, especially the big companies with an IT department running its own email server, tend to have some form of greylisting: if it is the first time they receive an email from our system, then they refuse it temporarily, and ask our system to retry in (for example) 5 minutes. Mailgun manages this nicely, but during those 5 minutes, the user is still waiting his/her magic link.

Postmark doesn't allow marketing emails, so their reputation scores are better and hence they have better deliverability. That's their main value prop.

I know about this, and about Postmark great deliverability, but the greylisting some companies use is naive and doesn't care about reputation: if you are a new sender, you to have wait 5 minutes and retry, whoever is sending (Postmark or Mailgun).

This. I think Slack is doing this perfectly, they still use passwords but emphasize the magic link email. I find it a lot easier to just use the magic link the first time I join a new slack. Then once you are logged in you basically never need to log out and if you ever need to reset the password its just a click away.

"... friction for those few people who aren't always connected to their e-mail system."

I'm not sure the size of this population is well understood to be able to label them as "few" - it may be few for a given set of services, but may be many for a different set of services.