News for hackers. Stuff that matters.

A comment on Cierge – passwordless authentication.

Re:Cierge – passwordless authentication by esdott on Thursday January 11, 2018 @10:24PM (#16130165)
Very cool. The magic link/email address as a ready made authentication platform feels very comfortable from a usability perspective. I’m curious if the venerable crowd here at HN has experienced any downsides to this approach. Are we (over)extending a notoriously easy to pown target in email by using this approach? Or is it just considered the same level of security as say a normal user/pass setup? I know zeit uses it for their system and that’s a gateway to applications/websites/micro services/etc. I have to say that I like using it because it’s so easy but I’m not sure what the implications could be in aggregate.

Edit: changed a word for clarity.

[ Parent | on HN ]
Re:Cierge – passwordless authentication by subway on Thursday January 11, 2018 @11:38PM (#16130438)
I can't help but feel that this is of equivalent or better security for users on sites that allow password-reset-by-email.
[ Parent | on HN ]
Re:Cierge – passwordless authentication by croon on Friday January 12, 2018 @04:59AM (#16131710)
Premise: I just bought a Shield so I could start using Netflix on my TV (they still don't have an installable application for my old HTPC).

On topic: I generate all my passwords (variable length 30+ characters), and to log into both the Shield and (as a family account) my wife's phone, I had to type (or copy/send) the entire password in using a directional remote or a phone keyboard. No magic email link, no netflix.com/auth request, no PIN number, no personal wife account that I could include into my family plan.

Passwordless solutions can't come soon enough. the email route is fine for me, though I'm sure there could be better solutions too.

[ Parent | on HN ]
Re:Cierge – passwordless authentication by IanCal on Friday January 12, 2018 @05:35AM (#16131885)
Netflix is one of the few things I've seen that supports google's Smart Lock for signing in. If I'm signed into the same account on my Shield as I use on my laptop, the signin is automatic for me.
[ Parent | on HN ]