Magic/tragic email links: don't make them the only option

Re:Magic/tragic email links: don't make them the only option by miki123211 on Wednesday January 08, 2025 @03:26AM (#42632206)

One of the biggest advantages of magic links is that they're unphishable while still being easy to use (unlike passkeys).

Having a code completely negates that advantage, as attackers can just set up a fake website that asks for the code.

Magic links should log you in on the device you click them, not on the device that requested the login session. Anything else, while being a little bit less annoying, is a security issue and should be treated as such.

[ Parent | on HN ]

Re:Magic/tragic email links: don't make them the only option by tarxvf on Wednesday January 08, 2025 @06:21AM (#42633076)

That would require I have my email on every device I might want to log in with.

I don't like that for a number of reasons.

[ Parent | on HN ]

Re:Magic/tragic email links: don't make them the only option by hombre_fatal on Wednesday January 08, 2025 @01:46PM (#42637181)

The conventional password system requires you to have a shared password manager on every device or that your reuse or memorize passwords. And that none of the service's users reuse passwords.

It's all trade offs, else it would be easy.

[ Parent | on HN ]

Re:Magic/tragic email links: don't make them the only option by miki123211 on Wednesday January 08, 2025 @03:44PM (#42638248)

Not to mention passkeys, which people seem to be so enamored with.

[ Parent | on HN ]

Re:Magic/tragic email links: don't make them the only option by tarxvf on Thursday January 09, 2025 @09:50AM (#42646165)

I can access my password manager on my trusted device, and manually type in my password for whatever service on any other device. This is exactly what I do for the rare but important time when I need to login on a device I don't want to have total access to everything.

[ Parent | on HN ]

Re:Magic/tragic email links: don't make them the only option by hombre_fatal on Thursday January 09, 2025 @01:21PM (#42648395)

I see. Yeah, I pitch a scheme in a direct response to them where you can still let a magic link authenticate a session on another browser/device.

[ Parent | on HN ]

Re:Magic/tragic email links: don't make them the only option by hombre_fatal on Wednesday January 08, 2025 @09:21PM (#42640926)

When using magic links, you can still support the common UX polish of letting a user log in on a different browser/device.

If the user opens the magic link in the same browser that initiated the email, then just log them in. Otherwise, present them with the Apple-style "Do you want to authorize a login from 1.2.3.4 using Firefox on iOS possibly located in Portland, Maine? [Authorize] or [Reject]".

[ Parent | on HN ]