The "email is authentication" pattern • Hacker News Board

Re: The "email is authentication" pattern

#291

Post by oretoz » Sun, Sep 08, 2024, 9:43 AM UTC

nfw2 wrote: post #34

tptacek wrote: post #31

Earlier quoted context omitted.

Phone number , not phone.

How does an attacker gain access to a phone number without having the phone? Like physically stealing the sim card or something else?

As others have mentioned, SIM Swap attacks are very common where the attacker impersonates the victim and convinces the mobile operator to transfer the victim’s phone number (known as MSISDN in telecom parlance) to the attacker’s SIM. If you Google SIM Swap, you will find many instances of it.

From that moment onwards, all the 2nd factor SMS OTP go to the attacker.

There are APIs that are provided by mobile operators via aggregators such as Telesign, Prove, Vonage, Twilio etc. that can be used to check if a SIM Swap has happened recently on that phone number. That API is used by fintech companies and others e.g. when they want to check if a fund transfer is to be allowed or flagged up.

Re: The "email is authentication" pattern

#292

Post by sulandor » Sun, Sep 08, 2024, 9:45 AM UTC

kriops wrote: post #274

throwaway290 wrote: post #265

Earlier quoted context omitted.

More places is more opportunities for the baddies to get it.

Shamir it.

please wrap the whole thing as a trustworthy product

Re: The "email is authentication" pattern

#293

Post by echoangle » Sun, Sep 08, 2024, 9:46 AM UTC

fooker wrote: post #288

imron wrote: post #84

Earlier quoted context omitted.

Generally, no, unless you don’t care whether it’s delivered or not Too many people and companies abused this to the point that running your own mail server means much of the generic mail you send will end up in junk/spam folders.

It won’t even be delivered in most cases.

What would prevent delivery? I do some work for a small organization and we send out registration confirmations with a self-hosted webserver. I am not aware of any delivery problems there. Thats why I was surprised. Are we just lucky?

Re: The "email is authentication" pattern

#294

Post by afastow » Sun, Sep 08, 2024, 9:46 AM UTC

throwaway290 wrote: post #261

soerxpso wrote: post #259

Earlier quoted context omitted.

> the "lose your key, lose your wallet" thing is fundamentally incompatible with real users. You're allowed to store your key at the bank if this is an issue for you. It's less secure than memorizing it, but obviously equally as secure as your bank account is.

It is not equally secure, if bank loses you money you have recourse, if bank loses your key (a fire, a flood) it's gone.

I stay away from everything crypto but I don't see the difference. In both cases if they didn't make it right you'd go to the courts and make your case that they are at fault and owe you compensation.

Re: The "email is authentication" pattern

#295

Post by echoangle » Sun, Sep 08, 2024, 9:47 AM UTC

imron wrote: post #84

echoangle wrote: post #73

Earlier quoted context omitted.

Can you elaborate on „email sending isn’t free“? What are you using to host the webapp? Can’t you just set up your own mail server and send whatever you want?

Generally, no, unless you don’t care whether it’s delivered or not Too many people and companies abused this to the point that running your own mail server means much of the generic mail you send will end up in junk/spam folders.

For a login link, I wouldnt really care if its in the spam folder. The person is actively looking for the mail, surely they will find it? It's different for marketing or similar content, but for expected mail, I wouldn't care.

Re: The "email is authentication" pattern

#296

Post by kgwgk » Sun, Sep 08, 2024, 9:56 AM UTC

afastow wrote: post #294

throwaway290 wrote: post #261

Earlier quoted context omitted.

It is not equally secure, if bank loses you money you have recourse, if bank loses your key (a fire, a flood) it's gone.

I stay away from everything crypto but I don't see the difference. In both cases if they didn't make it right you'd go to the courts and make your case that they are at fault and owe you compensation.

In the first case, bank deposits are insured. In the second case, safe deposit boxes are not insured.

Re: The "email is authentication" pattern

#297

Post by stavros » Sun, Sep 08, 2024, 10:04 AM UTC

echoangle wrote: post #295

imron wrote: post #84

Earlier quoted context omitted.

Generally, no, unless you don’t care whether it’s delivered or not Too many people and companies abused this to the point that running your own mail server means much of the generic mail you send will end up in junk/spam folders.

For a login link, I wouldnt really care if its in the spam folder. The person is actively looking for the mail, surely they will find it? It's different for marketing or similar content, but for expected mail, I wouldn't care.

You'd be surprised at how many messages I've gotten about expected emails not arriving, only for them to say "oh yeah, it was in spam, thanks!".

Re: The "email is authentication" pattern

#298

Post by [deleted] » Sun, Sep 08, 2024, 10:08 AM UTC

archerx wrote: post #277

mewpmewp2 wrote: post #228

Earlier quoted context omitted.

Since you wouldn't want to reuse passwords how is it to remember them?

Base password plus company name or initials. One password mutated into infinite variations that are easy to remember. This has been working fine for me for at least 15 years.

[deleted]

Re: The "email is authentication" pattern

#299

Post by suprjami » Sun, Sep 08, 2024, 10:09 AM UTC

archerx wrote: post #277

mewpmewp2 wrote: post #228

Earlier quoted context omitted.

Since you wouldn't want to reuse passwords how is it to remember them?

Base password plus company name or initials. One password mutated into infinite variations that are easy to remember. This has been working fine for me for at least 15 years.

What do you use for the base password? The website name?

So if someone finds out your password for a certain site is `Facebook1234ABCD` they have a fair guess at every other password?

Same applies for `MyPasswordFB` using the reverse method.

Re: The "email is authentication" pattern

#300

Post by afastow » Sun, Sep 08, 2024, 10:33 AM UTC

kgwgk wrote: post #296

afastow wrote: post #294

Earlier quoted context omitted.

I stay away from everything crypto but I don't see the difference. In both cases if they didn't make it right you'd go to the courts and make your case that they are at fault and owe you compensation.

In the first case, bank deposits are insured. In the second case, safe deposit boxes are not insured.

They're just different things. The FDIC insurance is for if the bank itself goes insolvent and they literally don't have enough money to cover their depositors' balances anymore. There's no reason a safe deposit box would be affected.