Why passkeys are a step back for personal security: examining account lockout risks, platform lock-in, hardware key limits, and fragile recovery flows.
The best implementation of this I’ve seen has to be Ghost, an open source self-hostable newsletter/patreon thing. They detect what email provider you have and when you enter your email, will display a link to open your inbox. It’s super neat, and I haven’t seen it anywhere else, and I’m also not sure how they do it. For something self-hostable, I’ll definitely take one less attack vector.
A DNS lookup on a domain says who runs the email server for email users on that domain (that’s how email senders figures out how to send you messages), and if that host is a known one then you can just pull the link to show. If you’re self hosting email then a few solutions can be recognized and login shown by guessing that the email software’s default URL pattern is used.
The best implementation of this I’ve seen has to be Ghost, an open source self-hostable newsletter/patreon thing. They detect what email provider you have and when you enter your email, will display a link to open your inbox. It’s super neat, and I haven’t seen it anywhere else, and I’m also not sure how they do it. For something self-hostable, I’ll definitely take one less attack vector.
A DNS lookup on a domain says who runs the email server for email users on that domain (that’s how email senders figures out how to send you messages), and if that host is a known one then you can just pull the link to show. If you’re self hosting email then a few solutions can be recognized and login shown by guessing that the email software’s default URL pattern is used.
I figured it was something like that, thanks for the explanation!
Doesn’t help if you’re not using a huge provider such as Gmail or Hotmail
It worked with ProtonMail