Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The "email is authentication" pattern

rubenerd.com

Post reply on HN
Print view View original

41–50 of 474 posts

Re: The "email is authentication" pattern

#41

Post by jpalomaki »

nfw2 wrote: post #30
tptacek wrote: post #3

Email accounts are the highest common denominator in online authentication. Phones are competitive, but people lose phones. Phone numbers are more common and durable, but the security of phone numbers is leagues below that of a flagship provider email account. It makes sense that so many authentication flows work this way. When designing a "fantasy football" alternate authentication system for the Internet, start wit…

Can you expand what you mean when you say the security of phone numbers is leagues below email? If someone can gain access to someone's phone, it seems like they would gain access to their email as well.

Phone companied have customer support. This is a weak point, because attacker can use social engineering to gain access to your number.

Re: The "email is authentication" pattern

#42

Post by MBCook »

bigstrat2003 wrote: post #19
MBCook wrote: post #15

Earlier quoted context omitted.

Who copy and pastes from a password manager? Here’s my workflow, and I consider it superior to both of the above. Go to site, Safari offers to autofill, give TouchID/FaceID, get asked for a 2 factor code. Sent via SMS/email? Safari offers to autofill for me. TOTP style? Safari offers to autofill for me. Easy peasy. Passkeys are even easier as there is no second step and waiting for SMS/email.

> Who copy and pastes from a password manager? People who don't use something which integrates with the browser. People who run into the (uncommon but noticeable) edge cases where the password manager decides to not auto fill the password.

When it doesn’t work I get. I run into that from time to time.

But I don’t think normal users want ones that don’t sync or integrate with the browser. I believe you can turn both off for Safari but that defeats the whole purpose in my mind.

Re: The "email is authentication" pattern

#43

Post by fragmede »

nfw2 wrote: post #34
tptacek wrote: post #31

Earlier quoted context omitted.

Phone number , not phone.

How does an attacker gain access to a phone number without having the phone? Like physically stealing the sim card or something else?

bribe, coerce, and social engineer a phone company employee into transferring the victims phone number to you, or a technical attack to get the system to send the sms messages to a device you control, without ever touching the victim.

Re: The "email is authentication" pattern

#44

Post by fragmede »

dogcomplex wrote: post #21

At this point why not just pass a one-time url link to your email address, and have it be a single click to login? Have it expire within 10 mins if not used, and be one-time use disposable. Still, anyone who has the link initially should be able to login with your account - but it's only accessible from your email. Obliterates all sense of security beyond the email account itself, but that's where we're at anyway. Do…

There are a number of sites that do exactly that.

Re: The "email is authentication" pattern

#45

Post by Zanfa »

nfw2 wrote: post #34
tptacek wrote: post #31

Earlier quoted context omitted.

Phone number , not phone.

How does an attacker gain access to a phone number without having the phone? Like physically stealing the sim card or something else?

The attacker just needs to convince/compromise a single carrier employee to get a new SIM for your number.

Re: The "email is authentication" pattern

#46

Post by 57FkMytWjyFu »

nfw2 wrote: post #34
tptacek wrote: post #31

Earlier quoted context omitted.

Phone number , not phone.

How does an attacker gain access to a phone number without having the phone? Like physically stealing the sim card or something else?

Sim swap via pretending to be a clueless customer who lost their physical phone, banking on lax checks at customer service.

Re: The "email is authentication" pattern

#47

Post by fragmede »

paulgerhardt wrote: post #8

I’ll be hyperbolic and say the login flow is identical. A) Go to website, click through a password manager to copy and paste an arbitrary string of characters, receive TOTP request sent to your email to confirm your identity. Or B) Go to website, click forgot my password. Receive link to login. Enter an arbitrary string of characters. In many instances, login flow B is actually quicker and seldom slower. Clicking the…

This flow is made shorter if you have the TOTP stored and filled out by the password manager.

Re: The "email is authentication" pattern

#48

Post by sunnybeetroot »

dogcomplex wrote: post #21

At this point why not just pass a one-time url link to your email address, and have it be a single click to login? Have it expire within 10 mins if not used, and be one-time use disposable. Still, anyone who has the link initially should be able to login with your account - but it's only accessible from your email. Obliterates all sense of security beyond the email account itself, but that's where we're at anyway. Do…

I agree this is a great way but don’t forget not everyone is signed into email on their device.

Re: The "email is authentication" pattern

#49

Post by dishsoap »

paulgerhardt wrote: post #8

I’ll be hyperbolic and say the login flow is identical. A) Go to website, click through a password manager to copy and paste an arbitrary string of characters, receive TOTP request sent to your email to confirm your identity. Or B) Go to website, click forgot my password. Receive link to login. Enter an arbitrary string of characters. In many instances, login flow B is actually quicker and seldom slower. Clicking the…

TOTP is not really something that would be sent to your email. The entire point of TOTP is that you can generate the auth code yourself, from the current time and a pre-shared secret.

Re: The "email is authentication" pattern

#50

Post by quectophoton »

candiddevmike wrote: post #29
tptacek wrote: post #3

Email accounts are the highest common denominator in online authentication. Phones are competitive, but people lose phones. Phone numbers are more common and durable, but the security of phone numbers is leagues below that of a flagship provider email account. It makes sense that so many authentication flows work this way. When designing a "fantasy football" alternate authentication system for the Internet, start wit…

Government provided digital IDs would solve a lot of this. Yes, they may have their own problems, but outsourcing the action of identifying individuals to the government seems valuable and less prone to "lock outs" like Google and friends.

It certainly is an alternative we can at least think about.

On one hand, the certs you'd use to login to websites wouldn't even need to include any personal info at all, just a valid signature from a CA that the website knows how to verify. And the certificate wouldn't need to be the same for every website, it could be one you generate for a specific website.

On the other hand, a lot of thought would need to be put into how expiration/renewal and revocation would play into this.

Of course there should be an evaluation of the ways this could go wrong if someone from the gov misuses this CA, and how that compares to someone from your current email provider misusing their permissions.

But if nothing else, something I really want is to just be able to have an email address like `random_id@my_country.my_country_tld`, to at least have an email address where I don't have to worry about being locked out, so that I can give freely to ISP, bank, grocery delivery websites, other local companies, etc. Most of this stuff I wouldn't even mind receiving as postal mail anyway. And if shit hits the fan, I can recover access to this email account by walking to an office and identifying myself.

Post reply on HN