Comment by capableweb | Hacker News Reader

Comment by capableweb | Hacker News Reader

Article fails to mention that "Magic Links" are not only possible via email, but any out-of-band method, so you could use Whatsapp, Telegram or IRC even. Obviously, the user is assumed to have a secure setup regarding whatever method you send the link via.

Which the "Email Security" section kind of hints to as well, that it's important users have a secure email setup. What they fail to mention, is that this is important not only if you use "Magic Links" but also if you have username+password login with "Reset my password" functionality, as otherwise intruders will be able to change your password anyways.

In conclusion, the article seems to have been written with the goal of saying "Everyone is using Magic Links, how can we get them to use Zitadel (their product) instead?", rather than an honest look on how "Magic Links" can be made more secure.

> "honest look on how "Magic Links" can be made more secure"

Challenge accepted. Here's my best practice list. (I should put this into a blog post!)

* Prefer them for accounts that are infrequently used or low risk.

* Test for conversion or goal uplift if possible with this.

* Offer the user choices; some people will prefer username/password, some magic link, some social sign-on.

* Ensure that users understand that whatever the destination is (email, whatsapp, slack, etc), the security of their app account is now tied to the destination's security. Understand that most folks care far more about their email or other destination than they do about access to your app.

* Understand the UX tradeoffs (around mobile browser issues). Document them if possible

* Make sure everything is over HTTPS. (Duh :) ).

* Set timeouts for links appropriately and communicate that to your users. ("This link is good for X minutes." "This link expires at HH:MM.")

* Warn users that access to the link is the same as access to the account. "Don't forward this email".

I think that's everything I'd say. I would love to hear if I missed something.

Great, now I'm going to spend the evening designing a login system that uses IRC private messages to deliver a magic link (or something, maybe ask for TOTP via the IRC chat?) for fun.

How should an honest look at the topic include for your, that's lacking in the article? You mentioned the focus on email instead of other channels. Anything else? Thanks for the feedback.

Reply on news.ycombinator.com