by gepeto42 on 1/7/25, 9:06 PM with 504 comments
by rickcarlino on 1/7/25, 9:29 PM
1. Include a fallback sign-in code in your magic link, in case the user needs to log in on a device where accessing their email isn’t practical.
2. Make sure the sign-in link can handle email clients that open links automatically to generate preview screenshots.
3. Ensure the sign-in link works with email clients that use an in-app browser instead of the user’s preferred browser. For example, an iOS user might prefer Firefox mobile, but their email client may force the link to open in an in-app browser based on Safari.
by sebastiennight on 1/8/25, 6:49 AM
1. Some users (0.1%) just don't ever get the email. We tried sending from our IP, sending from MailGun, sending from PostMark, having a multi-tier retry from different transactional tools. Still, some people just will not ever be able to log in.
2. People click old Magic Links and get frustrated when a 6-month old link "doesn't work". We've decided to remedy that by showing them a page that re-sends the link and explains the situation (like Docusign does) instead of an error message.
3. People will routinely mis-spell their email and then blame the system when they don't get the code.
All of this still results, I feel, in way fewer support tickets than the email+password paradigm, so I'm still in favor of Magic links.
by dpifke on 1/7/25, 11:03 PM
I could understand requiring a third factor to authenticate if signing in from a different location or a different ISP than I've been using for the past 5 years, but it's ridiculous to do so if nothing has changed (except the final octet of my DHCP-assigned address) since I last signed in yesterday. I use a different computer (via SSH) to read my email than I do for web browsing, and cutting-and-pasting a signin link that's hundreds of characters long (spanning multiple lines in Emacs, so I have to manually remove \ where it crosses line boundaries) is a PITA.
Adding friction on every sign-in colors all subsequent interactions I have with an app, and makes me hate using it.
by filmgirlcw on 1/7/25, 10:08 PM
Ricky Mondello wrote a really great blog last week[1] about how passkeys, as OP alludes to at the end, can be used alongside Magic Links, that I think is worth a read.
[1]: https://rmondello.com/2025/01/02/magic-links-and-passkeys/
by lolinder on 1/7/25, 10:04 PM
Every implementation of passkeys I've seen has presented me with the option to create a passkey after I've already logged in with some other method. I'll admit that I haven't dug into it deeply, but the UX I've been presented with consistently makes passkeys appear to be an alternative to the "Remember this computer" button, not to passwords in general. Somehow the service has to know that this new device is authorized. I know depending on the provider there's such a thing as passkey syncing, but that doesn't solve the problem of getting the initial authentication done.
The key insight with magic links is that your security system is no stronger than its recovery mechanism. We are never going to get to a world where passkeys are treated as the only authentication mechanism—there will always be a recovery mechanism, and in most cases an automated one via email. Given that that is the case, magic links simplify things by just not pretending that we have a more secure layer on top. By making the recovery mechanism the primary means by which you interact with the authentication flow you're being more honest about the actual security of your auth system.
Edit: filmgirlcw has a link to an article that is much better than this one that explains how the two actually complement each other: https://news.ycombinator.com/item?id=42628226
by adastra22 on 1/8/25, 5:32 AM
Anthropic has been the once exception to this personal policy simply because Claude is the best LLM out there. But it's a mountain of pain every time I have to re-login, and I've complained to them multiple times about this.
by jerieljan on 1/8/25, 2:51 AM
When links in email come into mind, so does phishing.
I hate these magic links a lot.
by jameshart on 1/7/25, 9:18 PM
by pwdisswordfishz on 1/8/25, 8:17 AM
To be fair, in-app browsers should die, especially those without an "open in regular browser" opt-out – which RSS readers should readily offer anyway.
by yawaramin on 1/7/25, 9:39 PM
This gets the best of both worlds: the security of passkeys on existing devices, and the passwordless setup and account recovery for new devices.
Bonus: it even avoids vendor lock-in where cloud providers have all your passkeys.
by gregates on 1/8/25, 2:18 AM
They can present it as a "more secure" login method, obscuring the reason they actually like it.
by pjerem on 1/7/25, 9:27 PM
You still need another method for the first login.
by muppetman on 1/8/25, 3:02 AM
by MrDunham on 1/7/25, 10:11 PM
I seriously HATE magic links. My email inbox is barely better a social network's time suck. Lots of urgent, little important, wrecks any flow I had.
Forcing me into my inbox is highly likely to cause me to forget about the reason I was there (to get into your app). Or, at best, it slows me way down and nearly always breaks my flow.
Perhaps this is acceptable for the security boost (?) for the average user, but man, when I get forced into magic links I sometimes just abandon the app altogether.
Disclaimer: 1. I have/pay for a password manager, which helps with the forgotten password problem a lot. It also allows me to have extremely hard-to-crack passwords.
by FriedPickles on 1/8/25, 12:44 AM
by m4tthumphrey on 1/8/25, 11:51 AM
by buro9 on 1/8/25, 11:02 AM
I've received magic links to my Gmail account that belong to other people, for accounts that have ordered flight tickets, or clothing, or digital services.
Those people, I guess they now have no way to access their online account, as they cannot password reset (if that was the fallback), or change their email (usually requiring confirmation), or receive their magic link.
There's nothing I can do here, except to delete the email, I don't have any indication as to what the correct email should be, and the person's name is the same as my legal name and there are a lot of people with that name in the World.
Few services verify an email during sign-up, because I'm sure data shows that added friction during sign-up results in fewer people signing up.
by albert_e on 1/8/25, 4:57 PM
Magic links and OTPs have become common for many other sites I use -- Udemy, Teachable etc. come to mind.
Recently I bought a cheap "smart watch" for my kid. Mostly for the digital display with configurable clock faces and simple step counting. The app would refuse to activate the watch unless we provide a valid mobile number and OTP. Why the hell do I need to give them a working mobile number just to use a smartwatch. Even if I wanted (which I did not) to get notifications / calls / texts / caller ID / contacts from my paired smartphone ... the smartwatch app does not need to know my phone number for that functionality to work. Feel so powerless.
by n144q on 1/7/25, 11:36 PM
by dbalan on 1/7/25, 9:29 PM
by rubslopes on 1/7/25, 11:02 PM
I'm building something for a very tech illiterate audience, and everybody loves the simplicity of it.
by jvanderbot on 1/8/25, 12:15 PM
I'm quite fast at passwords and 2fa. The whole thing is second nature, I have a password scheme to deduce the password for any site but keep them long and high entropy, and I can do 2fa calculations from any trusted device without taking my hands off the keyboard (thanks to oathtool), and anyway my passwords are sync'd securely and I can look them up with hands on keyboard.
This is strictly better than "single point of email failure". Why force me to be less secure and less usable.
Please, just allow me to use passwords and regular old TOTP.
by scott_w on 1/7/25, 9:31 PM
Obviously, your mileage may vary but it was a good reminder to always validate your assumptions, especially in your critical user flows.
by ivanjermakov on 1/8/25, 12:17 AM
by billy99k on 1/7/25, 9:17 PM
by timvisee on 1/8/25, 8:03 AM
I creates a bar management/sales platform for our group of friends. It's self service so people purchase their products on their phone and pay later.
People get... intoxicated... after which passwords appear to become quite the problem. Magic links solved that.
To solve the multi device and in-app browser problem people can also open the links on another device. That'll show a short code they can enter on the original device to actually log in. It's not perfect, but it works.
I do fully agree that passwords should always be an option as well.
by mediumsmart on 1/8/25, 3:59 AM
by dandigangi on 1/7/25, 11:33 PM
by o999 on 1/7/25, 11:07 PM
by doener on 1/8/25, 6:41 AM
by scarface_74 on 1/7/25, 9:35 PM
With Stratechery, once you get to the website with the magic link, I can then copy the authenticated podcast RSS feed to Overcast and the authenticated RSS feed for the articles to NetNewsWire.
Those subscriptions are then synced to Overcast and NNW on my iPad and Mac via iCloud.
Each podcast RSS link is personalized and you go to the show notes page and click on the link to Manage your account. It will take you to the website using the embedded browser where you can manage your subscription and get access to the various feeds.
Speaking of Overcast, even though its doesn’t create a username and password by default, you can create one. But it’s only to access the web version of Overcast.
by methou on 1/8/25, 12:41 PM
by Halian on 1/8/25, 1:01 AM
by perryizgr8 on 1/8/25, 1:53 AM
by paxys on 1/8/25, 12:35 AM
by lyime on 1/8/25, 12:28 AM
by littlestymaar on 1/8/25, 12:33 PM
by tonymet on 1/8/25, 1:49 AM
1. enter username
2. choose password or magic link (select password)
3. enter password properly
4. Thank you for logging in. Please click your magic link to log in.
Why did you waste my time putting in a password when the magic link was the only option?
by openplatypus on 1/8/25, 12:54 PM
Our response to above: https://wideangle.co/blog/passwordless-authentication-magic-...
Conclusions:
Magic Links good? Yes.
Magic Links the best? No.
by Kwpolska on 1/8/25, 2:11 PM
by SV_BubbleTime on 1/8/25, 5:01 AM
We dumped them for a host of reasons, but included in there was their use of tragic link logins.
Absolute clowns. Glad to see this practice getting the negative attention it deserves.
by ejs on 1/7/25, 9:40 PM
Since the application only sends a weekly email (a markdown template for goal/task tracking) it seemed easier to just use a magic link, only.
I am happy at how much easier the auth code ended up, and fail to see much downside for such an application.
I'm not sure it would be a good system for more complex apps and services.
by Helmut10001 on 1/8/25, 6:53 AM
by Terr_ on 1/8/25, 6:48 AM
On the other hand, training users to expect and use hard-to-read login-links in emails is not really good either. It promotes a broad range of scams, phishing, and potential malicious code exploits, even if the a particular sender's site has been hardened somehow. (e.g. a TOTP app on a phone.)
by jackthemuss on 1/8/25, 7:08 AM
by theltrj on 1/8/25, 1:02 AM
by catchmeifyoucan on 1/7/25, 9:25 PM
by shortformblog on 1/8/25, 3:43 PM
by marketneutral on 1/7/25, 9:27 PM
by justin_ on 1/8/25, 7:11 AM
The "email is authentication" pattern
https://news.ycombinator.com/item?id=41475218
by albert_e on 1/8/25, 4:56 AM
Unfortunately blocked on my (work) network -- classified as miscellaneous / unknown category.
by Saris on 1/12/25, 2:52 AM
by cco on 1/7/25, 10:09 PM
Agreed with some other folks that Passkeys is not a replacement for email verification.
by kleiba on 1/7/25, 9:51 PM
Would it be possible to bookmark the login link so that in the future I don't first have to go to my email in order to log into the service?
by rednafi on 1/8/25, 2:29 AM
Auth is the worst part of building a service and sucks all the fun out of it. API auth is a mess because people can’t keep a token string secret. Now we need JWTs, OAuth, token refreshing, and a whole bunch of BS that no one enjoys.
One reason why OpenAI and Anthropic APIs are so much more fun to use than Google and AWS offerings is that you get a token and are responsible for keeping it safe. It makes the entire workflow dead simple. I’m not creating a new project or fiddling with IAM just to try out an endpoint.
by technick on 1/10/25, 7:37 PM
by Jean-Papoulos on 1/8/25, 7:25 AM
The most-devices people I know are those who have a laptop, phone and tablet. That's it, I literally cannot think of anyone I know with more then this, and most of those with tablets are using it for games or reading or for the kids.
Magic links are indeed the best solution for the average user. Type in your email with autocomplete, get a notification from the mailbox, click, click, and you're in.
by victorbjorklund on 1/8/25, 8:55 AM
by shark_laser on 1/8/25, 1:58 AM
There's even cooler ways that are already working including nsec bunkers.
This is the way of the future IMHO, most people just don't know it yet.
by chrisweekly on 1/8/25, 7:54 PM
by t0mas88 on 1/7/25, 9:43 PM
If you want strong security, offer passkey login. It's safer than email and much more user friendly especially with FaceID/TouchID on Apple devices.
by anotheryou on 1/8/25, 8:04 AM
by j16sdiz on 1/8/25, 8:24 AM
by Malcx on 1/7/25, 10:47 PM
by shoelessone on 1/8/25, 1:37 AM
by cratermoon on 1/8/25, 3:21 PM
by ahmedhanks on 1/8/25, 4:59 AM
by sergiotapia on 1/7/25, 11:58 PM
Even something small thing like email -> hit enter -> then we show password input, will cause me to stop using your service.
by _tom_ on 1/8/25, 6:17 AM
Don't send me a link, tell me where to find it, after I log in.
by lxe on 1/7/25, 11:12 PM
What? You have your email on literally every device -- be honest.
by WaitWaitWha on 1/8/25, 1:31 PM
In the US, because the Fifth Amendment Self-Incrimination Clause, passwords cannot be demanded. Passwords are testimonial evidence. [United States v. Hubbell (2000); re Grand Jury Subpoena Duces Tecum (11th Cir. 2012)]
Biometrics on the other hand are not. The court ruled that a defendant could be compelled to unlock a phone with biometrics because it is not testimonial. [Commonwealth v. Baust (Virginia, 2014); State v. Diamond (Minnesota, 2017)]
Basically, passwords cannot be compelled to be disclosed, while biometrics can.
There is similar legal stance in Canada, UK, Australia, India, Germany, and Brazil to name a few.
Finally, under duress, passwords can be held, while biometrics cannot, without self harm.
by withinboredom on 1/8/25, 8:24 AM
by imzadi on 1/7/25, 9:17 PM
by Mystery-Machine on 1/7/25, 9:28 PM
> 1. Multiple devices. Who doesn’t use at least a few computers weekly? I don’t have my email on my gaming PC, nor do I have it on my work laptops.
"Who doesn’t use at least a few computers weekly?"
I don't. And many, many other people.
See what I did there? I assumed that everyone's like me, just like you did in your blog post. Without data, both of us are wrong.
----
I'd add that magic links also act as a distraction: you open your email client, and it by default opens your inbox, and you start going through all of those unread emails that you just found in your inbox...
Shopify is a big proponent for magic links because they went all-in on their new "Shop" customer accounts. What a disaster. Branding something with such a generic word as "shop" is terrible and average customer doesn't understand that it's supposed to be a brand name.