If I'm going to be forced into two-factor authentication, I would much rather use TOTP than be forced to use a phone number. Phones can break.
Why Login Security Sucks
11–20 of 81 posts
Re: Why Login Security Sucks
#12Earlier quoted context omitted.
Magic links are annoying for users.
I always forget how stinking nice password manager autofill is until I have to fight with magic links because some service hates me. And most implementations I've seen only log you in from the new link the email sent, not the original page. So if you are trying to log in on a device your email isn't signed in on, you get to type the entire thing in on your second device.
> And most implementations I've seen only log you in from the new link the email sent, not the original page.
Probably because:
- Bad actor A attempts to login - User B sees the email and unthinkingly clicks the magic link - Bad Actor A now has access.
There are probably ways around this (browser session/cookies/IP/etc must match?) but that'd be a common enough scenario...
Common enough that e.g. Microsoft Authenticator switched from sending a notification that you can tap to approve/reject (same as scenario above) to needing to enter a 2-digit code that you also see on the webpage (so without seeing Bad Actor A's page you cannot enter the code and approve their login).
Re: Why Login Security Sucks
#13I know that crypto/blockchain is not super popular here, but the experience of logging-in to various dapps is pretty nice. The ”login” is the dapp showing the user a message to sign to prove they own the key, then you can sign the message, and that’s the whole login. There’s various ways to implement it, but here’s a quick tutorial for doing login with MetaMask. https://docs.metamask.io/wallet/how-to/sign-data/siwe/
This looks like any other public key crypto authentication (U2F) but more complex and less universally adopted?
How is this better than OIDC?
Re: Why Login Security Sucks
#14If I'm going to be forced into two-factor authentication, I would much rather use TOTP than be forced to use a phone number. Phones can break.
Yes. The absolute worst 2FA is SMS based, especially when they refuse to work with my VoIP numbers (I now have a $5/mo 2nd eSIM plan just for this since my primary SIM is data only).
IMHO, just let me check a box that enables me to ONLY use username and password all the time, no extra steps or IP-based captcha or “verify it’s you” by clicking an extra email. My passwords are unique and strong and the provider is more likely to get hacked than my passwords get cracked.
Re: Why Login Security Sucks
#15> It is unclear why generating a one-time password for the user is bad but if we call the password a "recovery code" it is suddenly sufficient.
The OTP is usually very long, highly randomized (you don’t get to choose Summer2024!), and designed to be stored offline somewhere as a break glass. Passwords typically follow none of those rules.
Re: Why Login Security Sucks
#16It could be a good thing to have a confirmed email in the database, in case a 3-letter-agency knocks on your door because of some highly illegal content on your site.
Re: Why Login Security Sucks
#17the problem is the threat models for different sites and apps aren't the same, and so security protocols that cover the maximum bases for compliance, identity, security, privacy, recovery, and moderation don't have a lot of flexibility.
the only thing that is going to change authentication is a new mode for working online and the death of the browser from AI rendering most of what we need.
maybe this polarizes, where on one end you have the resurgence of TUIs that raise the technical bar and normalize cryptography and key management for tech work, and at the other we have AI interfaces using a kind of real time biometric context, mediated by some opaque hardware integration. I would be surprised if we're still typing passwds and TOTP tokens in as little as 10 years.
Re: Why Login Security Sucks
#18This person is wildly overthinking their problems. Early in the piece, they marvel that it's somehow OK to email magic login links to people, but not to SMS logins. Yes: among other reasons, that's because there's nobody an attacker can realistically call on the phone or bribe at a neighborhood cell phone store to rehome an email account. Nobody wants to do away with SMTP more than I do, but everybody has it, and mos…
> they marvel that it's somehow OK to email magic login links to people, but not to SMS logins
The answer here is that, even if you aren't emailing magic links, you're emailing magic links: the "forgot my password" flow is effectively a magic login link, because it uses your email as your single authentication method. There's then no additional loss of security if you use magic links instead of passwords.
Re: Why Login Security Sucks
#19This person is wildly overthinking their problems. Early in the piece, they marvel that it's somehow OK to email magic login links to people, but not to SMS logins. Yes: among other reasons, that's because there's nobody an attacker can realistically call on the phone or bribe at a neighborhood cell phone store to rehome an email account. Nobody wants to do away with SMTP more than I do, but everybody has it, and mos…
What's wrong with TOTP? Are you using that term in a technical sense to mean something specific or are you referring to any situation where someone needs to consult an app on a second device to receive a code to present to the first device?
Re: Why Login Security Sucks
#20This person is wildly overthinking their problems. Early in the piece, they marvel that it's somehow OK to email magic login links to people, but not to SMS logins. Yes: among other reasons, that's because there's nobody an attacker can realistically call on the phone or bribe at a neighborhood cell phone store to rehome an email account. Nobody wants to do away with SMTP more than I do, but everybody has it, and mos…
> why unmasked TOTP seed storage is not in fact that big of a deal
Wait, why is it not a big deal? Isn’t this similar to storing a plain text password server side? (OK, not user generated). If my server gets hacked, doesn’t the hacker get all the totp’s for everyone, much like getting everyones password?