Hacker News Reader

> Emails are super easy to hack

Source? And if somebody hacks my Gmail account, won't they be able to access my Google-synced passkeys?

Magic link auth isn't any less secure than any site that has a password-reset flow.

A family member installed an app into their Android phone from the Play Store.

It was innocent enough until it asked for a truckload of permissions, like being able to change the launcher, which they ofc tapped "Allow" to since permission request fatigue is real and still a bit of an unsolved problem.

So the app delivered on its promise and changed their phone's launcher. It had a fake Gmail widget that showed them their mail but, of course, wasn't actually tied to the actual Gmail app and was an easy way of getting a refresh token for their account.

Bingo bango bongo: their email was now at risk.

They changed their password after I told them to right away upon them asking me to look at their phone because "it was slow."

> Magic link auth isn't any less secure than any site that has a password-reset flow.

Which is exactly the problem. Cloning someone's SIM/eSIM and immediately performing password resets is a well-known security issue.

If you are blanket accepting permissions passkeys do nothing to fix the attack you describe (on device phishing).

> Cloning someone's SIM

Yeah I don't trust SMS either, that's why I said email. You can do a lot more to protect your email account than your phone number.

It's very disconcerting to think about how many malicious apps like that must exist in the Play Store, but again, gaining access to someone's Google account is still game over if that's how you're syncing passkeys.

> what I'd REALLY F'IN LOVE to see go away is the passwordless/magic link auth flow

This seems really naive? That's the only flow that's at the basis if you get locked out. What else, do you put people on the phone to verify people by asking their name and date of birth? That's even worse!

I think they're referring to sites where that is the only way to sign in, which I have seen a few of. Basically you can never register a password or passkey, every sign in requires going to your email and waiting for the link to arrive.

I've seen Slack and Claude doing this among others, it's turned into one of my leading red flags for untrustworthyness.

I get the idea. If email links are secure enough to use for password resets, just do that every time. Then you eliminate a whole category of password attacks.

But it’s definitely annoying for a frequently used service.

Maybe this gets us closer to some idea of email being a more protected digital service, that has some legal guarantees?

Putting the potential negatives under the rug for a second…

I would be nice to have email that (1) you can’t get locked out of arbitrarily, (2) acts similarly to US mailbox (in its protections and universal service), (3) acts as an identity

Is this a bad idea?

Horrible idea. This will require every email vendor to certify with every country they provide service to that wants to do something like this, which will pretty much kill any small/indie email hosting providers.

I'd much rather have stricter legislation around password resets built into existing reg frameworks like PCI or HIPAA. If you store a form of payment or PII with a provider, then some form of human verification should be needed to perform a password reset.

Only if it's run by the state and free for every citizen. Forcing more bureaucracy on email providers will just make everything more centralized under Google and Microsoft.

It should be a mailbox with E2E encryption where the keys are stored on your ID card. Backups stay on secure servers that are legally protected from anyone including the police and only given out when you're getting a new ID at a government service center, encrypted with the cards public key so a hacker in the card issuing system can't steal it.

Every user gets a persistent address used as their identity, and any number of anonymous ones. Locking someone out would be both illegal and inconvenient for the government if all their official business is going through the mailbox.

I do it for small projects with about 10 infrequent users. They would ask me to reset it almost every time anyway.

Though next time I'll probably try oidc if I can find a common provider that isn't a hassle

A German neighborhood social network uses this, and I prefer this over all other sites I visit that have passwords.

I only need a new login link when I switch to a new browser or device, so it's not really annoying at all.

I think all Shopify sites also do it now? I'm migrating password managers and have been going over all of the old accounts I've had. Several sites that use Shopify for their stores now just don't accept any kind of a password.

I despise that too. One website (was it walmart?) gives me option to use that or a password, I select password and after entering it it tells me that it needs to verify my e-mail "for security" where I get link or code to log in.

At that point what's the point of password? Just an optional extra step?

Untrustworthy... yes.

I get more annoyed by the timeout it adds. Logging in 10 years ago? A thing of seconds.

Logging in today? Either magic links through mail (delivered to you within the next 30min thanks to graylisting or spam filters) or a login flow with requires 5 dialogs and 5 confirmation of "no, just log me in".

Correct; that's what I'm talking about. Sites that send you a link first before letting you enter a password (Spotify) are also on my bad list.

I mean, if the session token basically never expires it's kind of fine?

For services that have your PII or payments details, yeah, that should be the only way to do a reset. Super inconvenient but much less so than dealing with stolen identity or credit cards.

Majority of websites use email to authenticate (“forgot password” flow). Passwords/passkey is just an optional convenience for quicker login.

> Yes, there's the minimal risk of lockout if you lose access to the passkey (though almost every site I've used that implements pk's lays it on top of their traditional user/pass auth flow)

Exactly, if you lose your passkey you just sign in with your password like you did previously. I'm yet to find an app/website that has passkeys only and no passwords.

Seems like a total non-issue to me.

One of the big benefits of passkeys is that you can completely remove the ability to log in with a password!

Just spitballing here, but it seems like a good mix of phishing resistance & lockout recovery would be to have passkey-only auth, but with email recovery.

So no password login, but then you can recover your account by adding an additional passkey by receiving an email.

Just make sure you don't lose the passkey to log into your email.

Isn't it the same as my password manager's vault? I only remember my master password so if that vault is lost I can't even log in to my email

Kind of, but I have some of my most important passwords and account recovery codes duplicated on paper in a secure place. If there was ever a service that only allowed passkey login (do those exist?), you can't print those out.

I'd still prefer password+2fa+backup codes for email.

I wouldn't be okay with that. Say you're setting up a new iPhone with a new iCloud account because you forgot the password to your old one. (Unlikely scenario amongst us nerds, but very very likely outside of our bubble.)

If you want to log into, say, Google, but the passkey flow is the only way in, then you're almost-completely SOL unless you have some way of getting the passkey out of your iCloud keychain and into the keychain of the phone you're setting up.

If you still have your old phone, you can scan the QR code and get in that way. If you don't, then you're completely SOL.

Ok, so the big security risk that passkeys are supposedly designed to stop, is actually still there?

If you can still be phished, remind me what the point of any of this was, again?

Ignoring any supposed security benefits, personally I use it because it's much more convenient/ faster than logging in with a password since.

You're still slightly less likely to get phished if you only ever login with passkey and only use the password in case of lost passkey. Of course you could get phished that one time but entering your password once (maybe never) has got to be better than entering it daily.

I don't have any passkey accounts where I didn't start off with a password and after adding a passkey the password login method was always retained. What services are people using where you don't need to set a password?

Yes, at this point I have probably saved literal hours in time added up by being able to skip MFA prompts on sites/apps I use regularly via a passkey login flow. It was becoming ridiculous how often I'd hit a "verify who you are with your phone/email" gate even on services I use constantly, a gigantic waste of time.

> I love not needing to deal with 1Password's autofill being flakey and having to CMD-C/CMD-V passwords/passphrases/OTPs on these sites.

But that requires that website implement support for passkeys, and is that easier than just implementing a login form that doesn’t break password managers’ autofill?

Low risk of lockout, but about as high-severity as one can imagine. Yes in theory sites should offer a password fallback, but how many actually do? And of those that attempt it, how many get it right?

Not even Google reliably lets you fall back to a password, according to the comments in this article. Losing access to your google is anywhere from major inconvenience to professional disaster.

Expecting every user (site using passkeys) to implement complicated flows is a time-tested recipe for disaster, and it's a bummer to see that unfolding yet again with passkeys.

>Not even Google reliably lets you fall back to a password, according to the comments in this article.

I logged in with my google password (on my TV, the other method using my phone wasn't working for some reason) the other day even though I normally use a passkey from my phone or computer. It worked just fine.

Sometimes it works, sometimes it doesn't. I've had Google block my login because it was sus (it was a new computer or something...) and they wanted to verify a whole bunch of information. If you haven't given them that info, you just get locked out.

To the day where your device breaks, you had set a passkey to access your Google account (because the phone did prompted it up and you did not understand and clicked yes), you did not setup a recovery method (such as another email/SMS) or you did setup a recovery method that still depends on the Google passkey access (e.g. a second email account where you sign in with Google or has Google as a two factor verification!) and you are locked out of your Google account. Good luck at that point contacting Google assistance, you may as well consider that account as lost forever since there is no way to talk with an human being.

And unfortunately is something I start to see to family members/friends that are not tech experts when they ask me to setup them up a new phone... at least the passwords they would have written them in some notebook that they had at home, or always used the same for everything, but with passkey... and when you tell them that they lost access to their email, possibly the files backed up to Google Drive/Google Photos, etc they are surely not happy.

Also passkeys makes it difficult to get access to your account in an emergency scenario, what if I loose my phone and I'm not signed in to other devices? Maybe I've setup an SMS as a recovery method, but first I have to get to my phone company to request another SIM card, maybe I'm on vacation on the other side of the earth in vacation for 2 weeks, I'm locked out of my Google account, and from all accounts that uses the passkey as a sign-in method (including, for example, the account that I need to use to check in on my return flight, or my banking app that I need to pay stuff!)

Partner's mom lost phone. Partner called me with mom's password. I went to Find Hub. Entered email and password. "Hold on, we're sending the lost phone a verification text."

> and because those sync everywhere, this isn't a real risk.

Do they sync between Android and iPhone devices?

I wouldn't even know how to sync any of those to my Linux PC.

> those sync everywhere, this isn't a real risk I hope your main account at one of these two providers gets banned for whatever reason so you'll never utter such frivolous claims ever after :)

I'm in the same spot. It seems like every month a post pops up here that's "I hate passkeys" and most of HN seems to agree.

I use 1Password, but passkeys have made things even easier. I'd rather have them than any 2FA method. So many websites make me use a login/password AND then send me an email or text with a code. Every. Single. Time. You're really telling me you would rather do that than have a passkey?!

And, like you said, passwordless email auth is really terrible.