News for hackers. Stuff that matters.

A comment on Cierge – passwordless authentication.

Re:Cierge – passwordless authentication by kelvin0 on Friday January 12, 2018 @08:20AM (#16132579)
I am not sure I understand how it works from a user's perspective? I login (using only an email), receive an email with a 'magic link' and this directs me to my authenticated account?

If that is so for the user, how does it work for the site owner? Cierge calls my site and requests a login from a given email, then the site backend conjures a URL which Cierge will use to create the magic link sent back to the user?

It would be very helpful to better understand if they explained the workflow for users and site owners.

If anyone can help me understand this and how it's better than OAUTH (logging FB, Google...) I would be grateful.

[ Parent | on HN ]
Re:Cierge – passwordless authentication by TheGrumpyBrit on Friday January 12, 2018 @12:22PM (#16134501)
As far as I can tell, it's exactly the same as the password + one time code approach to 2FA...except without the password. Effectively the same as using Google Authenticator alone instead of in combination with a password.
[ Parent | on HN ]
Re:Cierge – passwordless authentication by biarity on Friday January 12, 2018 @05:11PM (#16136780)
Cierge is an OpenID Connect sever (which is based on OAuth 2), so your website would interact with it just as it would with non-passwordless solutions.
[ Parent | on HN ]