Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Emailing a one-time code is worse than passwords

blog.danielh.cc

Post reply on HN
Print view View original

31–40 of 816 posts

Re: Emailing a one-time code is worse than passwords

#31

Post by pandorobo »

anonymars wrote: post #9
jjani wrote: post #4

Earlier quoted context omitted.

Even with backups, the attestation issue makes them awful.

I'm not familiar with this issue and a quick search didn't turn up anything obvious. Would you mind elaborating?

Specifically they are referring to synced passkeys (passkeys generated by services like Google password manager/1Password/Apple and are linked to that account).

Because these passkeys are stored in the Cloud and synced to your providers account (i.e. Google/Apple/1Password etc), they can't support attestation. It leads to a scenario where Relying Parties (the apps consuming the passkey), cannot react to incidents in passkey providers.

For example: If tomorrow, 1Password was breached and all their cloud-stored passkeys were leaked, RP's have no way to identify and revoke the passkeys associated with that leak. Additionally, if a passkey provider turns out to be malicious, there is no way to block them.

Re: Emailing a one-time code is worse than passwords

#32

Post by sriku »

DecoPerson wrote: post #19

The attack pattern is: 1) User goes to BAD website and signs up. 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.” 3) BAD’s bots start a “Sign in with email one-time code” flow on the GOOD website using the user’s email. 4) GOOD sends a one-time login code email to the user’s email address. 5) The user is very likely to trust…

A while ago, I implemented a signin approach that looks similar to this "send a link/code" mode but (I believe) can't be exploited this way - https://sriku.org/blog/2017/04/29/forget-password/ - appreciate any thoughts on that.

Btw this predates passkeys which should perhaps be the way to go from now on.

Re: Emailing a one-time code is worse than passwords

#33

Post by eddythompson80 »

hooverd wrote: post #3

I thought this was going to be about Passkeys. Maybe if the FIDO Alliance can stop being obstinant and allow real backups, I'd be all in on them.

What do you mean by real backups? What's stopping you from backing up your keys? Its up to the passkey "provider" to allow passkeys backup/sync.

Re: Emailing a one-time code is worse than passwords

#34

Post by deathanatos »

ripped_britches wrote: post #5

They aren’t ideal but are they actually worse than passwords? I’d bet that on net, more compromises happen with previously-leaked passwords

I haven't actually seen these being used as passwords like TFA states; they're usually a form of 2FA.

If they actually are passwords, yes, my password manager is a better UX than having to fetch my phone, open SMS, wait for the SMS, like good grief it's all so slow.

(In the 2FA form, I'd prefer TOTP over SMS-OTP, but the difference is less there.)

Re: Emailing a one-time code is worse than passwords

#35

Post by donatj »

pandorobo wrote: post #20

Very short, badly written article. It can't even describe phishing correctly... At least label your threat model correctly. While the premise is correct -- it's easy to complain but the author also provides zero recommendations on what is a better form of MFA.

You misread the short article.

It's about email as single factor auth, which has become very trendy of late. You just enter your email address, no password, and the email you a code. Access to your email is the only authentication.

Re: Emailing a one-time code is worse than passwords

#37

Post by pandorobo »

max__dev wrote: post #30
pandorobo wrote: post #20

Very short, badly written article. It can't even describe phishing correctly... At least label your threat model correctly. While the premise is correct -- it's easy to complain but the author also provides zero recommendations on what is a better form of MFA.

The article is not about MFA. It is about using email as a single factor.

Thats simple a lie or you didn't read the article.

The very first bullet point states: Enter an email address or phone number

That insinuates email OR SMS.

It doesn't just mention email only.

Re: Emailing a one-time code is worse than passwords

#38

Post by pandorobo »

donatj wrote: post #35
pandorobo wrote: post #20

Very short, badly written article. It can't even describe phishing correctly... At least label your threat model correctly. While the premise is correct -- it's easy to complain but the author also provides zero recommendations on what is a better form of MFA.

You misread the short article. It's about email as single factor auth, which has become very trendy of late. You just enter your email address, no password, and the email you a code. Access to your email is the only authentication.

The first bullet point mentions phone number.

- Enter an email address or phone number

Thats not just email, that's also SMS.

Re: Emailing a one-time code is worse than passwords

#39

Post by sophiebits »

pandorobo wrote: post #37
max__dev wrote: post #30

Earlier quoted context omitted.

The article is not about MFA. It is about using email as a single factor.

Thats simple a lie or you didn't read the article. The very first bullet point states: Enter an email address or phone number That insinuates email OR SMS. It doesn't just mention email only.

Half factor authentication, then, since either one will work.

Re: Emailing a one-time code is worse than passwords

#40

Post by drozycki »

DougN7 wrote: post #22
DecoPerson wrote: post #19

The attack pattern is: 1) User goes to BAD website and signs up. 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.” 3) BAD’s bots start a “Sign in with email one-time code” flow on the GOOD website using the user’s email. 4) GOOD sends a one-time login code email to the user’s email address. 5) The user is very likely to trust…

It sounds good, unless granny needs to visit Google or Microsoft to get a new password after losing her phone. Then what??

She follows same reset flow as before. Passkeys are identical in this respect to the passwords of yore.
Post reply on HN