News for hackers. Stuff that matters.

A comment on Magic/tragic email links: don't make them the only option.

Re:Magic/tragic email links: don't make them the only option by adastra22 on Wednesday January 08, 2025 @12:32AM (#42631267)
I refuse to use any service that only supports magic links for auth. It is incredibly user-hostile, and absolutely worse from a security perspective than passwords (with a password manager). Most critically it simply does not work in my personal setup where I do not have access to my email account from the machine I am using to login, precisely for security reasons and the safety of my accounts.

Anthropic has been the once exception to this personal policy simply because Claude is the best LLM out there. But it's a mountain of pain every time I have to re-login, and I've complained to them multiple times about this.

[ Parent | on HN ]
Re:Magic/tragic email links: don't make them the only option by apitman on Wednesday January 08, 2025 @02:30AM (#42631946)
Sadly not enough people use password managers for it to be worth it for companies to target those flows.
[ Parent | on HN ]
Re:Magic/tragic email links: don't make them the only option by adastra22 on Wednesday January 08, 2025 @04:27AM (#42632476)
60% of Internet users rely on a password manager, and that number is still growing by a significant amount each year.
[ Parent | on HN ]
Re:Magic/tragic email links: don't make them the only option by apitman on Wednesday January 08, 2025 @04:44AM (#42632550)
A quick search is indicating more like 30%, which honestly is way higher than I expected. Where are you seeing 60%?
[ Parent | on HN ]
Re:Magic/tragic email links: don't make them the only option by adastra22 on Wednesday January 08, 2025 @05:47AM (#42632877)
It is ~30% for personal use, and ~60% when you include personal + work. So 30% use it in both contexts, and an additional 30% just for work. A combined 60% use password managers in some capacity in their work or personal lives.
[ Parent | on HN ]
Re:Magic/tragic email links: don't make them the only option by apitman on Wednesday January 08, 2025 @02:13PM (#42637430)
Cool, thanks. Do you have a link to these stats?
[ Parent | on HN ]
Re:Magic/tragic email links: don't make them the only option by budding2141 on Wednesday January 08, 2025 @05:20AM (#42632763)
>absolutely worse from a security perspective than passwords

Is it though? Majority (if not all) services I frequently use have email as recovery option for forgotten passwords.

[ Parent | on HN ]
Re:Magic/tragic email links: don't make them the only option by adastra22 on Wednesday January 08, 2025 @05:43AM (#42632861)
It is certainly not all, and most security conscious sites offer other recovery options like one time use codes. Many also allow for time delayed account recovery, which aren’t a usable option for magic links.

In any case the correct approach here is to fix password reset/account recovery (e.g. with social key recovery) rather than reduce everything to the lowest common denominator.

It also can be said to lower security because it instills the behavior of clicking on links in incoming emails as a standard practice.

[ Parent | on HN ]