Hacker News Reader

Comment by mfkp | Hacker News Reader

I think that #3 (Log users in from emails clicks automatically) is the most important here. I hate it when I click a link in an email, then immediately have to log in. Half the time it's not worth the effort and I close the tab. I would guess that conversion ratios can be improved by a large amount by automatically logging users in via a token in the email link.

View on HN

OKCupid puts login tokens in their links used in their notification emails, so that when you click on them, you're automatically logged in. Convenient, right? But what if a novice user copies the link and sends it to a third party ("hey, take a look at this match!"), not knowing the significance of the extra data in the URL?

http://edelsont.livejournal.com/14163.html

Authentication tokens should expire after first use; other sanity checks:

1. Tokens should expire after no more than five minutes.

2. Embed a 1-pixel image in an HTML-based e-mail also contains the token. When the e-mail is first opened, the server associates the IP address from the e-mail with the token. Only subsequent authentication requests for that token/IP address pair pass validation.

3. Log IP addresses used by an account. Additional new IP addresses outside the usual geographical area (GeoIP) should fail validation. This assumes that the first person to click the link is the intended recipient.

Any other ideas?

Use a persistent identification cookie even when the "remember me" checkbox isn't used. By themselves, neither the cookie nor the email nonce are enough to authenticate. But if you have both at once, you are authenticated.

This will cover almost everybody, it will have almost no false positives (forwarding an email to somebody who uses the same browser on the same computer is the only one I can think of off the top of my head), and the fallback of requiring explicit authentication in other cases seems acceptable.

These are all ideas which would cover maybe 80% of use cases, but severely annoy the remaining 20%. Is that a good idea?

The fallback can be that you have to log in with a password. Which is bad, but apparently tolerable.

2 Won't work any more now that Google have led the charge with downloading images in email messages to their own servers and serving them to users themselves.

I expect all email providers to follow Google's lead on that tbh because it's really quite good.

3 is a bit of a problem with residential broadband as IP address get re-assigned a fair bit.

I assume a lot of that is protecting the account or identity from people forwarding an email to friends.

One that I find a bit annoying is clicking a link to reset a password, then having to login again with that same password. Seems a bit unnecessary.

This is most annoying when they're asking me to write a review or respond to another customer's question. They're already asking me for free labor. They want to add their security to my list of chores. They must invision a bot which intercepts emails for products and writes positive or negative reviews depending on who is paying the bills.

The problem is exacerbated by the fact that I'm usually checking those emails on the phone where it is often a PITA to enter passwords.

How long would you consider reasonable before requiring the user to enter a password when clicking through an email? Basically, how long should the token be valid from a user perspective?

From a developer perspective I think unless you are comfortable with a 1-2 week token* (or longer depending on customer base) you could actually decrease conversion rates because you remove the features consistency.

Ex: a user is cleaning out emails, starts with the most recent and works their way back. Opens OkCupid message from 3 weeks ago because it was interesting, but the link doesn't work.

*I would appreciate further insight as to what is a normal length of time for tokens to be valid and the impact increasing the token expiration time might have on security.

In this situation the user would already be logged in from opening newer emails, so opening the older emails would use their existing session, even though the token has expired.

Or if the user visits an old email without looking at a new email first, the user can just log in as usual.

Reply on news.ycombinator.com