Hacker News Reader

Comment by anderspitman | Hacker News Reader

IMO[0] everyone should have at most one password - to their email account. Everything else should be something along the lines of (in order of preference):

1) SSO (federated! Not the Google/Twitter/Facebook/GitHub oligopoly nonsense we have now), using email addresses as ids.

2) Emailed login links, a la Slack's magic links.

Email addresses aren't perfect, but they're the globally unique, federated IDs we have, and good enough. Plus they have the advantage of years of figuring out how to handle of realities of federation.

[0] I am biased. I recently launched a service in this space: https://emauth.io

View on HN

I hope that emailed login links cease to exist.

I work at a large company. As a combination of lots of security scanning and, I think, intentional slowdown for virus spread mitigation, external email can take minutes to be delivered.

More than 50% of the time I receive such a link (including from Slack, for example), it has timed out before it gets to me.

Just let me use a good, long, randomly-according-to-a-recipe-generated (and, if needed, 2FA) for services and I'm happy.

Seems pretty specific to large organizations though? That's a completely different thread model than someone wanting to log in to their social network to share cat memes. You're completely right that it needs to be handling differently and appropriately. But for everyday use, I've never had an issue with delivery on commodity email providers.

Email is an incredibly vulnerable single point of failure. Plus the existing password infrastructure of the web isn't going away. Password managers are the best and most realistic option for most people.

Yes, but it's an incredibly vulnerable single point of failure now, not just as a hypothetical.

I found out that when I added a backup email to my gmail that it had the opposite effect that was desired - losing access to the backup email meant I couldn't recover the account even though I still had access to the primary. I still can't get over the perverse, Kafka-esque feeling, years later. Partly because I am still logged in, yet I have no way of restoring my "ownership" and using it again.

Reply on news.ycombinator.com