Ask HN: Why aren't one-time sign in links more popular for authentication?

Re:Ask HN: Why aren't one-time sign in links more popular fo... by radu_floricica on Monday January 04, 2021 @05:53AM (#25629727)

I'm assuming you intend those links to be single-use only and expire automatically, in which case what I'm writing below doesn't apply. Nevertheless, the problem is big enough to be worth repeating and re-repeating:

Any link that ends up in a browser address bar should be treated as public.

And no, it doesn't matter if you use HTTPS. Ways to leak it are many, but the gist is that it's treated as "meta-data" and, rightly or wrongly, subject to much lower expectations of privacy. A recent scandal was that several common browser extensions collect this meta-data and sell it to marketing companies.

Which marketing companies offer searchable subscriptions (for hefty prices, true, this isn't a $9.99 service), where somebody could for example search for "yourcompany.com", or even worse, "yourcompany.com/authernticate?token=". Yeah, meta-data.

[ Parent | on HN ]

Re:Ask HN: Why aren't one-time sign in links more popular fo... by hnick on Monday January 04, 2021 @06:53PM (#25639968)

I was working on an ecommerce site once and we got emails when customers left reviews/feedback. I forwarded them to customers because it was a convenient way to show their comments then follow up.

Then I noticed that some of the text was wrapped in a tokenised link to the platform managing our reviews, bypassing the login screen. Support said they could not revoke these tokens. We had to close the entire account and migrate everything.

[ Parent | on HN ]

Re:Ask HN: Why aren't one-time sign in links more popular fo... by squiggleblaz on Monday January 04, 2021 @06:30AM (#25630002)

How do you advise we handle email address confirmation and password resets?

[ Parent | on HN ]

Re:Ask HN: Why aren't one-time sign in links more popular fo... by aaronhayes on Monday January 04, 2021 @06:42AM (#25630100)

Automatically expire the links

[ Parent | on HN ]

Re:Ask HN: Why aren't one-time sign in links more popular fo... by squiggleblaz on Monday January 04, 2021 @07:04AM (#25630252)

Yeah but you can do that with login token URLs as well. The person I replied to said "you can never do that", not "you can do that only if you exercise suitable caution". I am asking for an alternative that fits with the "you can never do that" perspective, not a way to backpedal.

[ Parent | on HN ]

Re:Ask HN: Why aren't one-time sign in links more popular fo... by squiggleblaz on Monday January 04, 2021 @09:31AM (#25631758)

Apparently I completely ignored the first comment in the original post. Apologies.

[ Parent | on HN ]