Ask HN: Passwordless vs. password-based login, which one to use? | Hacker News Reader

Ask HN: Passwordless vs. password-based login, which one to use?

8 pointsdevdiary13 comments

In the context of an average user who might not be as tech savvy as we developers are, which authentication method is more suitable? I understand that for majority, we need to find a balance between security and ux+accessibility. Which auth method will win in that case?

View on HN

I think the "magic link" (a.k.a passwordless) method of authentication is actually great for the average user, particularly as many (most?) of them will be on mobile, where passwords are an absolutely pain. They're also useful as you don't have to use email, you can instead send out the link via SMS, WhatsApp etc. which can drive people to mobile (if that's what you want).

That said, here on HN you will probably get a different response, as people here are generally power-users and much more privacy and security aware (not a bad thing). There was a good discussion on this yesterday:

https://news.ycombinator.com/item?id=32080540

I'd be interested to hear the security argument for or against magic links.

Magic links improve security on a couple of fronts. For one, they prevent users from making weak passwords, which let's face it, most people likely fall into this category. One could argue that strong password requirements do the same, but in reality they compel many users to reuse the same "strong" password, weakening security overall. Magic links prevent this entirely. Secondly, they protect users from weak auth implementations, leaked password hashes, passwords stolen through brute force attacks, etc. Because there are no passwords.

I don't have much of a security argument against magic links. I suppose an attacker that gets access to your email now automatically has access to the application. But frankly that is true for passworded apps as well, given the "forgot my password" workflows out there.

Completely agree with that

Agree. I want to hear the same about magic links. The thread you linked about does not talk in context of an "average user". Security choices we make in context of an average-user vs power-user can be a lot different.

Passwordless logins can be really handy but it can be an absolute painful experience when using desk top computers and mobile devices.

If you have an iPad and you want to access your site, you will receive the link in your mailbox and then need to send the link via Airdrop or other means to your iPad. It's always a bit of struggle for some of online training sites that use this approach

"Passwordless" is a huge group.

Honestly, I personally like passwords. When using a password manager they are very secure and very convenient. Plus they are understandable, I know how to back them up, enter them in a different device and more. Everyone knows how they work and what to expect.

Magic links can solve problems for users that don't have a password manager set up, but can be less convenient for those who do. Assuming you allow password resets via email anyway it is more secure.

U2F/WebAuthn is much more secure but hard for users to manage right now. This is getting better with Apple, Google and Microsoft coming up with systems to sync the keys across browsers (as long as you stay within their ecosystem).

Client certs are the most secure but lack infrastructure to make it convenient. It has basically been obsoleted by WebAuthn.

Some sites support WebAuthn[0]. It's supported on the latest Yubikeys, but there is the caveat that the Yubikey could get damaged/stolen/lost, and you have to have some recovery method in place. Most services employ a single use recovery code mechanism that you store somewhere trusted and safe. IMHO Passwords are here to stay. 'Passwordless is the future' is a marketing ploy that hasn't gained traction.

[0] https://en.wikipedia.org/wiki/WebAuthn

I don't like passwordless logins because between the occasional lag to get the email, the risk of ending in spam, and the fact sometimes it doesn't work (if I'm trying to log in incognito but the mail handler trigger the default browser in normal mode)... it just doesn't feel as foolproof. If both options are offered its fine, but sites that are 100% passwordless annoy me

A good passwordless system should send both link + OTP so that when you open up in incognito or simply open on another device where you don't have email logged in, you can enter the OTP.

I like how notion does that - they have OTPs(they call it login code) as a 4 word sequence that can be easily remembered and entered on the other device/tab without reading+typing letter by letter. If you have email client open, just click on their magic link, if not, just copy-paste or type in their login code.

I'd have said it to be mandatory requirement but it does depend on the use case IMO.

I think it depends entirely on your use case. If the user isn't storing a lot of info in your app then passwordless is the way to go.

Also, important to recognise that replacing a password with a different single factor does not enable passwordless as used by most enterprise companies. Passwordless implies two factor, with both factors not including a password.

General rule is to use what people are used to, which is passwords. Don't innovate outside of your USP.

Follow up question - what are some tools that can help implement secure passwordless auth?

A quick search on GitHub shows these results

1. SuperTokens - https://github.com/supertokens/supertokens-core (seems to have most extensive feature sets and support for multiple passwordless methods - email, phone, otp, etc.)

2. Paw.js - https://github.com/jrjr/paw.js (looks like an implementation of passkey, interesting)

Reply on news.ycombinator.com