Hacker News Reader

> so leveraging all the work that has gone into making e-mail secure is a win.

What? Email isn't close to secure.

The point is that e-mail vendors (e.g., Google, Microsoft) have dedicated far more resources and effort to securing their e-mail software (e.g., GMail, Hotmail) than start-ups will, or can, dedicate for their own authentication component. (For example, how often are all GMail passwords been stolen?)

I am suggesting that the authentication process for e-mail is far more secure than what a start-up could produce to authenticate for their own site. I am not suggesting that e-mail is NSA-proof.

One can hardly count on users always having one of the big provider mail accounts and beyond the big providers, most email is still sent across the wire unencrypted. Email isn't generally script kiddy proof, let alone NSA proof.

While I like the idea of login via email link, it's only good if the login link expires very quickly.

Email is not an auth mechanism, if you want to rely on the big providers to do auth, they have systems specifically for that already.

Most websites use email as the password recovery mechanism. "Authenticate by email" is strictly better than "authenticate by password or email".

Reply on news.ycombinator.com