Why Email Only Auth Is More Secure

🌎 Find Me Here:

#Shorts

[nico_qwer]

Everybody chillin’ until you login into your email account this way 😂

[deimiosxxx]

Would be simple if sending mail would be simple.
Setting up a mail server ( Postfix + DKIM + SPF + DMARC ) is enough pain as it is, but once some providers blacklist you randomly, your auth is done.
Also as others have pointed out, training your users to click random links in emails is a recipe for disaster.
It's not a good idea to introduce a dependency on thirds parties for your auth. Remember when Google auth dropped for half a day?
Select your usecase carefully, for auth there is no golden path.

[fed-yum]

I came across the first site that demanded I now login this way. I deleted their information from my password manager and I'll never go back there again.

[TheGarageboyz]

Perfect timing. Need to implement this on a project. Thanks!

[vella]

But it will give hackers more chance of fishing attacks...with a fake link

[MikeDest]

Nice how it removes a level of liability on your end. Even if your site got hacked and db dumped there wouldn't be any password hashes. Would probably generate a lot of customer service emails from users never getting a login email for whatever reason. It would be good to have an SMS backup option where it texts them the url.

[sasikantht]

That's exactly how Vercel logs you in. Cheers!

[chbrules]

There are trade-offs for all forms of MFA. I could just as well argue that SMS MFA is just as secure. Both have the risk of being hacked by a targeted attack. Both are usually under direct control of the user trying to authenticate as well. There is always a trade-off over security and usability.

[borstenpinsel]

2 negative points: it's the same as using the same password for a service and email. If they got into your email, the service is immediately comprised as well. And it's really inconvenient for the user

[meet]

So the token will be sent in the url? Or bases on that token another token will be created that will be sent to the user?

[GreggObst]

Medium does this with their login. It's great until you are trying to login to medium on your work computer to read articles that are relevant for work and your place of employment blocks gmail so you can't get to the link that medium just sent. "Except for that bit at the end Mrs Lincoln, how did you enjoy the play"?

[patricknelson]

That’s _ok_ but I still sorta prefer when folks support multi-provider OAuth, e.g. Google, Apple, etc. Then I don’t have to create an account *and* importantly I _also_ get 2FA (in my case via Google). That 2FA is also more secure than typical SMS/Email since it uses app (ideally it’d be rolling code or something, but oh well). Then, password based auth as a failover with authy/authentication app 2FA, but I understand not all users are savvy enough to understand how to use/support that.

[trollingdirty]

Much easier to compromise one credential (email) than it is infinite (if you use a password manager) and the UX for going to email is absolutely horrible.

Please STOP doing things because we can, do things because we should.

[PostMeridianLyf]

Mobile 2 factor is pretty good when you use a cloud phone number.

[JerryNoel]

What about implementing both? Wouldn't that be even more secure?

[anggoran]

Wouldn't it open a chance for someone to spam a certain email address?

[chrtravels]

It’s not good if you want to verify one real person per account though.

[funnyanimalworld]

There goes alitle bit more than that but basic explanation is ok

[haliszekeriyaozkok]

if you do that user and developer have to hide that email and email is always more easy to find. I don't think that's more secure. Because hiding email is hard, everyone's email is saved somewhere.

[anasouardini]

a good name would be (exclusive 2 Factor Authentication) E2FA