Comment by mapgrep | Hacker News Reader

Comment by mapgrep | Hacker News Reader

This turns your email inbox into a giant password manager, except without the extensive storage encryption used by real password managers. Thought experiment: What are the possible unintended consequences of that?

Just a few off the top of my head:

1. Easier for email hackers to detect sites where you have logins. (Controlling someone's email usually means controlling most/all logins, but it takes some digging to get a good list of vaulable logins. With this solution, most of the list is on the first page or two of the inbox.)

2. Harder to detect being hacked. (Previously, a hacker with email access would have to reset your passwords, and you will notice that at least some passwords have changed. Now the hacker just has to delete any incoming authentication emails after reading them.)

3. Losing a job becomes potentially more catastrophic. (Hope you didn't associate too many passwords with your work email, because IT wiped your account while security was escorting you out the door. And before you say only dumb people use work email for personal accounts, consider that part of the idea of this nopassword system is to help "dumb people" who fail to (for example) use password managers.)

4. Your email provider now has a nice easily mined record of what sites you log into most often. But, hey, I'm sure we can all trust Google not to use that information in a terribly creepy manner, right?

It would be interesting if email started adapting to this new use. For example, if we standardized around these login emails being sent from login@url.com, then you could set up a rule to automatically delete any email from login@url.com after 5 minutes. Over time, if this caught on, you could imagine this being standard practice by email clients vs. a custom rule.

This of course only solves problem (1) that you mentioned and possibly(?) (2) partially.

It occurs to me that this is kind of an interesting evolution of systems like 1Password, where the user experience is very similar: you have one password that gives you access to other passwords. Similarly here, your "one password" is your email password, and that gives you access to what is conceptually a new password on every login (vs a pre-generated one).

I wonder if we couldn't solve 3 and 1 together by creating a "login email provider". For example, pretend dropbox wanted to offer this service. Dropbox gives you an @dropbox.com email specifically for logging into places. When a login email was sent to you, you would go to dropbox and navigate to the logins tab, which would have a very non-emaily interface showing you the last login links that were sent to you (again, auto deleted after 5 minutes -- and since this is not meant to be used as normal email there is no expectation for them to last longer). If websites only supported "known" services like @dropbox.com for this kind of login, then the (3) could be solved. Maybe to make things even clearer, the .login TLD could be used or something.

You could accomplish a lot of this with a Chrome extension that operates on your gmail window. Heck, it could even listen for login emails and open the tab automatically when they arrive.

It seems like you think this would replace bank login's, which it won't, but rather this is perfect for about 90% of the sites out there that require a username/password.

1 & 2. If your email is hacked, the least of your concerns is what else is being accessed. No matter what, if someone controls your email then you are screwed. We've seen enough examples of that being true.

3. Well, if you don't remember your password and you no longer have access to the email you're in trouble as well. Password managers are great, but there is still some use cases where they don't work very well and I've had keepass go corrupt on me once before.

4. They already know all the sites you visit (if you're really worried about it). You still get password resets, user account confirmations, and weekly notifications from most sites.

If your email is hacked, you don't necessarily even know your email is hacked. With traditional username/password authentication, an attacker has to reset passwords to leverage email, and you have a very god shot at noticing a password somewhere changed. Under this scheme it is much harder to notice "you are screwed," as you put it. The attacker gets to decide WHEN you find out about the compromise.

And yes it's possible to figure out which sites I visit from my Gmail, and yes it's possible to lose your job AND forget your password all at once, but these issues are made exponentially worse by the "email a login token every time" scheme outlined in the article.

I think this just helps make it even more painfully obvious that email is the single point of failure for the vast majority of web site authentication security. This takes out a step, but it doesn't change what is already possible for an attacker to do.

Proposals for browser plugins and special protocols that use email for authentication have been around for a while too. It's just a matter of mainstreaming them. Which I hope never happens until we make sure email is as secure as a password manager.

I personally would like to disable the ability to reset my password via email on every one of my accounts (and disable resetting by "security questions" too.). I have all those passwords in my password manager, backed up on all my computers, an external disk, and the cloud. I won't need to reset my password. (Except when the service provider forces me too, like Dropbox recently did.)

I think a major problem would be one of the most-common use-cases: you're away from your PC, and want to access their site.

To do this, of course, you'd have to get an email sent to that machine. Then, you must login to your email on that same machine to get the PW, and thus the problem: now you have a much greater chance of leaving your email logged in on the 3rd-party machine. Whether it's a friend's laptop or a public terminal (library, airport, etc.) this is not a good thing whatsoever; all you needed to do was to login to a site to post a comment on some silly discussion board, and now you've left the keys to your kingdom in the open.

Further, if there are actual security issues with that box, say it's actively being MitM'd, keylogged, etc. well instead of simply gaining access to your silly forum account, now they will have access to your email.

I think I would flat-out refuse to use any service for these flaws.

What if you could get an SMS, or the email on your phone, and type 5 letters into a box on the website?

Normally this would be more work, but if you're away from your email it might be a good alternative..

It would be great to be able to authorize a login for another machine. I could request a login on any machine and have an email/sms sent to my smartphone and click the link there (alternatively, scan a QR code), and get authorized on the machine initiating the login.

Email/SMS would be an obvious security hole for people who just click "OK" without reading, though. I guess a QR code would be secure anyway.

>This turns your email inbox into a giant password manager

I already use my primary email for this purpose. Most passwords I memorize, but some, for services with requirements so arcane that memorization isn't possible, I just email to myself with a unique key I remember. To get the password, I just search my email for the key.

Yes, this makes me vulnerable if my email is ever compromised. But my primary email is already a single point of failure and pretending otherwise doesn't do me any favors.

I could use a password manager, which would have the advantage of encryption. But it's also limited to those places I have access to it. I can store the database in my dropbox, but that limits the platforms I can access it from (at least, without some serious headaches) and makes the whole process that much more painful.

It might be worth pointing out that most password managers also use email for authentication.

If they made the email link stop working after initial use, that would solve a bunch of these problems.

(not sure if that's how it works or not)

5. Your "password" is being sent via an insecure protocol.

6. Your "password" being stored in the clear via cookies on your machine.

The sites which would consider using this already have email password resets and persistent session cookies, which have the same problems.

It wont work because the password cannot be used from another machine, as i understand. But If a new request is made, it will be logged, but that may not be good enough. Ya if you lose email address and simultaneously lose access to the system from which you originally logged in, you may not ever be able to login.

Couldn't the links expire to prevent most of these issues?

The links are one-time only, and they expire.

All of those points apply directly to every log-in system that currently allows you to reset your password via e-mail.

5. Your smartphone gets stolen.

Reply on news.ycombinator.com