Hacker News Reader

>How do you prevent credential stuffing attacks?

Passkeys or magic links seem like the way forward here.

Please don't. I find such services obnoxious, especially when they aggressively log you back out. Chasing down a link in your email is much slower than having your password manager fill in the long unique random password and hitting "log in".

>Chasing down a link in your email is much slower than having your password manager fill in the long unique random password and hitting "log in".

That's basically a passkey without its special API.

You can also randomly generate a password for the user on the form they'd normally type one in on registration. Add a "Regen" button to give users more visceral control over it before they submit the form.

That's essentially the same as magic links because most users won't remember/save that password and will have to rely on the usually email-based reset flow.

Sure, but this subset of user was going to otherwise reuse their password and be susceptible to cred-stuffing.

The point is to stop the attack and prevent users from accidentally hosing themselves.

Isn't that essentially a manual passkey?

Reply on news.ycombinator.com