News for hackers. Stuff that matters.

A comment on Show HN: Emauth.io – Free service for Slack-style passwordless login links. Parent comment

Re:Show HN: Emauth.io – Free service for Slack-style passwor... by jesseendahl on Monday January 06, 2020 @11:03PM (#21976717)
> I've run into this a lot for things like when I want to log in to a public computer, such as to print something. Having a logged-in device with you makes this much quicker.

Again, this flow is still very much possible with a design that verifies session ID. Please re-read my last comment and gregmac’s comment carefully!

To be really clear, you can design it so that you:

(1) start the login process on a public computer, (2) click the link on a mobile device, and (3) end up logged in on the public computer. And you can do this while ensuring that the session ID is the same in steps #1 and #3.

[ Parent | on HN ]
Re:Show HN: Emauth.io – Free service for Slack-style passwor... by anderspitman on Tuesday January 07, 2020 @10:57AM (#21981138)
I think I see where the confusion is coming from. emauth essentially already works the way you're describing. It validates whatever session makes the original request. Having the link isn't enough to login on its own.
[ Parent | on HN ]