6

I see this advertised Medium post about building a React application with passwordless authentication through Auth0.

from the link, here is the explanation of how it works:

Passwordless authentication, as the name might imply, is an authentication system where the user does not enter a password. Instead, they provide an identifier such as an email address or telephone number, and the authentication system sends out a one-time passcode or link to this identifier that the user must then provide or click to successfully authenticate. The passcode or link is active for a limited time, often around five minutes. Each login request generates a new passcode or link and invalidates any previous passcodes or links. In a sense, passwordless authentication also provides two-factor authentication out-of-the-box, since a user must have access to either the email account or phone number they provide.

They also state that passwords are obsolete and insecure because people choose weak passwords and reuse them.

But here one asks Who watches the watchmen?

Since your email account is protected by the obsolete and weak means of a password, the passcode or link is not safe at all, is it? Someone just needs to crack your email and they get access to your application with Auth0 authentication.

Am I wrong?

Improve this question
3
  • 3
    Even if you're not using Auth0, an attacker getting access to your email account is generally enough for them to successfully attack most of your accounts via password reset emails and such.
    – Neil Smithline
    Commented Jul 18, 2016 at 21:39
  • Honestly and sorry for the words. I think their argumentation is bullshit and marketing blabla. You already stated the point, that there is no sense in sending a link in a probably unencrypted email to an email account that is protected by a simple password, which is probably stored in my insecure mobile device.... And SMS/text messages sent to mobilde devices are no good protection as the news over the last few weeks again demonstrated.
    – cornelinux
    Commented Jul 19, 2016 at 10:48
  • I think it's probably more secure for most people than the usual email + password authentication, but to describe it as "two-factor" authentication is misleading at best.
    – Flimm
    Commented Oct 21, 2020 at 8:46

1 Answer 1

Reset to default
5

Fundamentally, this sort of authentication is only as strong as the email account the user is using. However, the same criticism can be levied at any relegated authentication model - OpenID or OAUTH included. However, I think that this is still well worth it - by leveraging existing services that users value, it means that they are not tempted to use throw-away or repeated/re-used passwords on your site. You'll be reinforcing the value of those central auth sources (in this case the email), and hopefully that will lead to users using strong authentication in those cases.

Also, authentication is hard to do right - so many smaller sites (and even huge ones) mess it up. Passing that off, whether via this Auth0 or via more traditional OAuth or OpenID, is a great idea. I don't see anything fundamentally wrong with the emailed token approach.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .