The trouble with email magic links

This is probably a bit controversial.

I recently suggested that someone reconsider their identity provider because it supports email magic links: the links you receive by email that sign you in automatically when you click them.

Problem one: links get pre-fetched

Most of these links are pre-fetched by email providers, either for caching or for spam detection. Now imagine all of those sign-in links also passing through the email security plugins that inspect your inbox.

Problem two: the flow crosses devices

All but a couple of the providers I examined let the sign-in flow start on one device and complete on whichever device the user clicks the link. That is literally ripe for abuse and account takeovers.

If a sign-in can start on one device and finish on another, the attacker gets to choose which device starts it.

To my surprise, quite a large number of identity providers fall into this bucket.

Convenience vs. expertise

I understand that a business wants to solve its customers' problems and make its product convenient to use. Quite often, builders learn their requirements from their customers.

Security, though, is a domain where the business has to be the expert on the domain and its requirements. It should help customers understand the risks of each choice, educate them, and offer options accordingly.

And no, I wasn't trying to sell them my solution 😀