Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why Login Security Sucks

matduggan.com

Post reply on HN
Print view View original

21–30 of 81 posts

Re: Why Login Security Sucks

#21

Post by tptacek »

lll-o-lll wrote: post #20
tptacek wrote: post #10

This person is wildly overthinking their problems. Early in the piece, they marvel that it's somehow OK to email magic login links to people, but not to SMS logins. Yes: among other reasons, that's because there's nobody an attacker can realistically call on the phone or bribe at a neighborhood cell phone store to rehome an email account. Nobody wants to do away with SMTP more than I do, but everybody has it, and mos…

> why unmasked TOTP seed storage is not in fact that big of a deal Wait, why is it not a big deal? Isn’t this similar to storing a plain text password server side? (OK, not user generated). If my server gets hacked, doesn’t the hacker get all the totp’s for everyone, much like getting everyones password?

Because the secrets have no intrinsic value. If you believe your database has been compromised, you just invalidate them all. The problem with password compromise is that passwords are re-used: losing a user password is a big deal. There's a reason there's no "Has My TOTP Seed Been Pwned" site anywhere.

Re: Why Login Security Sucks

#22

Post by tptacek »

kibwen wrote: post #19
tptacek wrote: post #10

This person is wildly overthinking their problems. Early in the piece, they marvel that it's somehow OK to email magic login links to people, but not to SMS logins. Yes: among other reasons, that's because there's nobody an attacker can realistically call on the phone or bribe at a neighborhood cell phone store to rehome an email account. Nobody wants to do away with SMTP more than I do, but everybody has it, and mos…

What's wrong with TOTP? Are you using that term in a technical sense to mean something specific or are you referring to any situation where someone needs to consult an app on a second device to receive a code to present to the first device?

It's clunky and it's not phishing resistant.

Re: Why Login Security Sucks

#23

Post by pdonis »

tptacek wrote: post #22
kibwen wrote: post #19

Earlier quoted context omitted.

What's wrong with TOTP? Are you using that term in a technical sense to mean something specific or are you referring to any situation where someone needs to consult an app on a second device to receive a code to present to the first device?

It's clunky and it's not phishing resistant.

Not phising resistant compared to what?

Bear in mind the saying: it's impossible to make anything foolproof because fools are so ingenious.

Re: Why Login Security Sucks

#24

Post by tomsmeding »

wepple wrote: post #15

> It is unclear why generating a one-time password for the user is bad but if we call the password a "recovery code" it is suddenly sufficient. The OTP is usually very long, highly randomized (you don’t get to choose Summer2024!), and designed to be stored offline somewhere as a break glass. Passwords typically follow none of those rules.

> highly randomized (you don’t get to choose Summer2024!)

Sure.

> designed to be stored offline somewhere as a break glass.

That's fair.

> The OTP is usually very long,

No, 10 digits is not very long, that's just 10^10 (about 2^33). The xkcd password ( https://xkcd.com/936/ ) is better than that. It's better than Summer2024 perhaps, but not all that much better.

Re: Why Login Security Sucks

#25

Post by RadiozRadioz »

Controversial opinion: Username and password is perfectly fine.

To provide an example that most people here are probably comfortable with: An SSH key is effectively a really long password with cryptographic properties. It's a single factor, one thing, that you use to complete a challenge for the server. We are fine to use SSH keys as our only authentication factor for servers, with IP whitelisting where security trumps convenience; why should we feel uncomfortable using long passwords as our only authentication factor for websites, with opt-in MFA when security trumps convenience?

Instead, websites enforce terrible 8-20 character passwords with a recipe of strict requirements to help crackers, and a download of the flavor of the month authenticator app that quickly becomes burdensome and annoying.

Why does my library think they're Fort Knox and want me to get an authenticator app? The tech is fine, but its universal forced application bugs me. It's like those campaigning for enforcing MFA everywhere never considered that different users have different risk appetites/tolerances.

The problem with passwords comes when humans mismanage passwords and pick bad ones. Passwords themselves are fine.

Re: Why Login Security Sucks

#26

Post by tptacek »

pdonis wrote: post #23
tptacek wrote: post #22

Earlier quoted context omitted.

It's clunky and it's not phishing resistant.

Not phising resistant compared to what? Bear in mind the saying: it's impossible to make anything foolproof because fools are so ingenious.

Compared to any phishing-resistant authentication protocol.

Re: Why Login Security Sucks

#27

Post by lll-o-lll »

tptacek wrote: post #21
lll-o-lll wrote: post #20

Earlier quoted context omitted.

> why unmasked TOTP seed storage is not in fact that big of a deal Wait, why is it not a big deal? Isn’t this similar to storing a plain text password server side? (OK, not user generated). If my server gets hacked, doesn’t the hacker get all the totp’s for everyone, much like getting everyones password?

Because the secrets have no intrinsic value. If you believe your database has been compromised, you just invalidate them all. The problem with password compromise is that passwords are re-used: losing a user password is a big deal . There's a reason there's no "Has My TOTP Seed Been Pwned" site anywhere.

Losing a user password is a “bigger deal” when the password is re-used, I get this point.

> Because the secrets have no intrinsic value

This is too strong. In general, it’s not possible to know my database has not been compromised. TOTP invalidation isn’t a trivial thing either, particularly if it was used instead of passwords and not as a 2nd factor.

Re: Why Login Security Sucks

#28

Post by jrochkind1 »

RadiozRadioz wrote: post #25

Controversial opinion: Username and password is perfectly fine. To provide an example that most people here are probably comfortable with: An SSH key is effectively a really long password with cryptographic properties. It's a single factor, one thing, that you use to complete a challenge for the server. We are fine to use SSH keys as our only authentication factor for servers, with IP whitelisting where security trum…

Ah, so the problem is the HUMANS! This is great, because all we need to do is switch out the humans.

Re: Why Login Security Sucks

#29

Post by smcnally »

Dwedit wrote: post #11

If I'm going to be forced into two-factor authentication, I would much rather use TOTP than be forced to use a phone number. Phones can break.

> I would much rather use TOTP than be forced to use a phone number. Phones can break.

Phones / SMS is also less secure than TOTP. It’s odd that most orgs that require 2FA yet accept only phone calls or sms as the second factor are financial institutions.

Re: Why Login Security Sucks

#30

Post by radicality »

tptacek wrote: post #8
radicality wrote: post #7

I know that crypto/blockchain is not super popular here, but the experience of logging-in to various dapps is pretty nice. The ”login” is the dapp showing the user a message to sign to prove they own the key, then you can sign the message, and that’s the whole login. There’s various ways to implement it, but here’s a quick tutorial for doing login with MetaMask. https://docs.metamask.io/wallet/how-to/sign-data/siwe/

There is no less attractive use of blockchain tech than login. The biggest problem with login security isn't attesting to an identity, it's account recovery; blockchains make that incredibly difficult.

Fair enough, I guess for crypto wallets there isn’t any recovery that can be done if you lose the private key. In the end a cryptocurrency wallet is usually just a pub/priv keypair, so purely for login/identity purposes it’s similar to passkeys. And can be backed up easily.

What I wanted to say is that hopping around different ‘dapps’ is quite seamless from a login point of view (and has benefits like ability to pay for goods immediately). Often I don’t even proceed exploring some website if it asks me to create an account since the friction is high.

In any case, this popped into my head as I was exploring openrouter.ai yesterday (routing layer for LLMs, you buy credits and can use many models), and they had a “Login with MetaMask” option, which is rare for non-crypto websites, and it worked quite seamlessly.

Post reply on HN