News for hackers. Stuff that matters.

A comment on Magic/tragic email links: don't make them the only option. Parent comment

Re:Magic/tragic email links: don't make them the only option by hombre_fatal on Wednesday January 08, 2025 @01:46PM (#42637181)
The conventional password system requires you to have a shared password manager on every device or that your reuse or memorize passwords. And that none of the service's users reuse passwords.

It's all trade offs, else it would be easy.

[ Parent | on HN ]
Re:Magic/tragic email links: don't make them the only option by miki123211 on Wednesday January 08, 2025 @03:44PM (#42638248)
Not to mention passkeys, which people seem to be so enamored with.
[ Parent | on HN ]
Re:Magic/tragic email links: don't make them the only option by tarxvf on Thursday January 09, 2025 @09:50AM (#42646165)
I can access my password manager on my trusted device, and manually type in my password for whatever service on any other device. This is exactly what I do for the rare but important time when I need to login on a device I don't want to have total access to everything.
[ Parent | on HN ]
Re:Magic/tragic email links: don't make them the only option by hombre_fatal on Thursday January 09, 2025 @01:21PM (#42648395)
I see. Yeah, I pitch a scheme in a direct response to them where you can still let a magic link authenticate a session on another browser/device.
[ Parent | on HN ]