Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Emailing a one-time code is worse than passwords

blog.danielh.cc

Post reply on HN
Print view View original

61–70 of 816 posts

Re: Emailing a one-time code is worse than passwords

#61

Post by gethly »

totallykvothe wrote: post #7

I'm having difficulty understanding what it means for an attacker to "send your email to a legitimate service"...

It means that you go to foo.com and enter your e-mail to sign up. But foo.com routes that request and to bank.com, hoping you have an account there.

bank.com sends you verification email, which you expect from foo.com as part of the sign-up verification process. For some bat shit crazy reason, you ignore that the email came from bank.com and not foo.com and you type in the secret code from the email into the foo.com to complete the sign up process.

And bam! the foo.com got into your bank account.

A complete nonsense but because it works in 0.000000000000001% of the time for some crazy niche cases in the real world, let's talk about it.

Re: Emailing a one-time code is worse than passwords

#62

Post by baobun »

Ferret7446 wrote: post #54
donatj wrote: post #35

Earlier quoted context omitted.

You misread the short article. It's about email as single factor auth, which has become very trendy of late. You just enter your email address, no password, and the email you a code. Access to your email is the only authentication.

> It's about email as single factor auth, which has become very trendy of late I must be in the wrong bubble, I have not encountered any site that does this since the 2000s. It was a minor trend around then IIRC.

I believe Slack popularized this back then and still do it.

Re: Emailing a one-time code is worse than passwords

#63

Post by Almondsetat »

dogpuncher wrote: post #52
DecoPerson wrote: post #19

The attack pattern is: 1) User goes to BAD website and signs up. 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.” 3) BAD’s bots start a “Sign in with email one-time code” flow on the GOOD website using the user’s email. 4) GOOD sends a one-time login code email to the user’s email address. 5) The user is very likely to trust…

I don't understand your example. > 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.” Does that mean that GOOD must be a 3rd party identity provider like Facebook, Apple, Google etc?

This attack technique is called "real time phishing". If you need a diagram or a more detailed explanation, look it up

Re: Emailing a one-time code is worse than passwords

#64

Post by politelemon »

drozycki wrote: post #40
DougN7 wrote: post #22

Earlier quoted context omitted.

It sounds good, unless granny needs to visit Google or Microsoft to get a new password after losing her phone. Then what??

She follows same reset flow as before. Passkeys are identical in this respect to the passwords of yore.

Then that's worse, it's now two authentication flows to remember. It's only made the situation more complicated.

Re: Emailing a one-time code is worse than passwords

#65

Post by t_mann »

DecoPerson wrote: post #19

The attack pattern is: 1) User goes to BAD website and signs up. 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.” 3) BAD’s bots start a “Sign in with email one-time code” flow on the GOOD website using the user’s email. 4) GOOD sends a one-time login code email to the user’s email address. 5) The user is very likely to trust…

The problems of Passkeys are more nuanced than just losing access when a device is lost (which actually doesn't need to happen depending on your setup). The biggest problem are attestations, which let services block users who use tools that give them more freedom. Passkeys, or more generally challenge-response protocols, could easily have been an amazing replacement for passwords and a win-win for everyone. Unfortunately, the reality of how they've been designed is that they will mainly serve to further cement the primacy of BigTech and take away user freedom.

Re: Emailing a one-time code is worse than passwords

#66

Post by politelemon »

eddythompson80 wrote: post #33
hooverd wrote: post #3

I thought this was going to be about Passkeys. Maybe if the FIDO Alliance can stop being obstinant and allow real backups, I'd be all in on them.

What do you mean by real backups? What's stopping you from backing up your keys? Its up to the passkey "provider" to allow passkeys backup/sync.

Not really, they have no incentive to provide such a thing nor is it mandatory for them to do so.

Re: Emailing a one-time code is worse than passwords

#67

Post by baobun »

AgentME wrote: post #27
hooverd wrote: post #3

I thought this was going to be about Passkeys. Maybe if the FIDO Alliance can stop being obstinant and allow real backups, I'd be all in on them.

Passkeys on cryptocurrency wallets such as the Trezor and Ledger are tied to the device's seed phrase and can be backed up.

Did you try that? I can't find any confirmation on if it's actually working for classical keys but it's for sure not supported for resident keys on Ledger.

https://www.ledger.com/blog/strengthen-the-security-of-your-...

https://github.com/LedgerHQ/app-security-key/issues/6

https://github.com/LedgerHQ/app-security-key/issues/7

Is Trezor implementation more mature?

Re: Emailing a one-time code is worse than passwords

#68

Post by cuu508 »

drozycki wrote: post #40
DougN7 wrote: post #22

Earlier quoted context omitted.

It sounds good, unless granny needs to visit Google or Microsoft to get a new password after losing her phone. Then what??

She follows same reset flow as before. Passkeys are identical in this respect to the passwords of yore.

If granny forgets her password, she looks it up on the last page of her notebook where it is written down. Granny cannot write down her passkey.

To avoid getting locked out you could add 2-3 passkeys from different providers to each account. And/or use a passkey provider that allows backups, and back up your keys. But I doubt many people will have the discipline to do either of that.

Re: Emailing a one-time code is worse than passwords

#69

Post by moi2388 »

eddythompson80 wrote: post #59
Ferret7446 wrote: post #54

Earlier quoted context omitted.

> It's about email as single factor auth, which has become very trendy of late I must be in the wrong bubble, I have not encountered any site that does this since the 2000s. It was a minor trend around then IIRC.

Anthropic is the main one. Its pushing a lot of others to do the same. I literally was arguing against that 2 weeks ago and the person who was pushing it said "Claude does that. Its really slick, no password to remember". Patreon can do that too, depending on how you sign up.

It’s not slick at all. Passwords and MFA autofill, their image codes don’t, so I have to close the browser, go to email, copy code, delete email, go to browser, paste code just to login.

The entire email login flow is completely retarded. It’s not even secure.

Re: Emailing a one-time code is worse than passwords

#70

Post by atoav »

dogpuncher wrote: post #52
DecoPerson wrote: post #19

The attack pattern is: 1) User goes to BAD website and signs up. 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.” 3) BAD’s bots start a “Sign in with email one-time code” flow on the GOOD website using the user’s email. 4) GOOD sends a one-time login code email to the user’s email address. 5) The user is very likely to trust…

I don't understand your example. > 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.” Does that mean that GOOD must be a 3rd party identity provider like Facebook, Apple, Google etc?

BAD assumes:

1. you got login credentials at GOOD

2. you're using the same email address there

They then tell you GOOD will send you a code that you have to enter on their website.

Then they enter your Email on GOOD and request a reset, which sends a mail with a code to you.

You then enter the code on their website.

Now that they have the code they can enter it on GOOD and they have your account.

Post reply on HN