Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Emailing a one-time code is worse than passwords

blog.danielh.cc

Post reply on HN
Print view View original

161–170 of 816 posts

Re: Emailing a one-time code is worse than passwords

#161

Post by daemin »

Ferret7446 wrote: post #54
donatj wrote: post #35

Earlier quoted context omitted.

You misread the short article. It's about email as single factor auth, which has become very trendy of late. You just enter your email address, no password, and the email you a code. Access to your email is the only authentication.

> It's about email as single factor auth, which has become very trendy of late I must be in the wrong bubble, I have not encountered any site that does this since the 2000s. It was a minor trend around then IIRC.

Booking does it and it frustrates me to no end.

Re: Emailing a one-time code is worse than passwords

#162

Post by hulitu »

DecoPerson wrote: post #19

The attack pattern is: 1) User goes to BAD website and signs up. 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.” 3) BAD’s bots start a “Sign in with email one-time code” flow on the GOOD website using the user’s email. 4) GOOD sends a one-time login code email to the user’s email address. 5) The user is very likely to trust…

> Passkeys is the way to go. Password manager support for passkeys is getting really good.

And how do you access your password manager when your computer is locked ?

Re: Emailing a one-time code is worse than passwords

#163

Post by pas »

clement_b wrote: post #86

What's quite annoying is how agressive most products are into forcing this method over regular email+pw / Social Logins. Let me use my 100 chars password!

You are not the target audience, you are not even an outlier, it's probably time to accept this and look for long-term solutions that allow you to interface with the "mainstream".

Re: Emailing a one-time code is worse than passwords

#164

Post by continuational »

DecoPerson wrote: post #19

The attack pattern is: 1) User goes to BAD website and signs up. 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.” 3) BAD’s bots start a “Sign in with email one-time code” flow on the GOOD website using the user’s email. 4) GOOD sends a one-time login code email to the user’s email address. 5) The user is very likely to trust…

Easy to mitigate by only allowing the device that requested the 6-digit code to use the code.

Edit: See first reply, this is not a mitigation at all!

Re: Emailing a one-time code is worse than passwords

#165

Post by daemin »

charlesabarnes wrote: post #13

Wholeheartedly agree, however The Changelog Podcast helped shift my perspective on this. It's really about not having the responsibility of storing and maintaining passwords.

So if they don't want to store your passwords because they do not want the responsibility of keeping it safe, should you trust your credit card and other personal information with them?

Re: Emailing a one-time code is worse than passwords

#166

Post by pas »

ameliaquining wrote: post #56

So there are two complaints about this authn scheme that I'm seeing in this thread: 1. It's pretty phishable. I think this is mostly solved, or at least greatly mitigated, by using a Slack-style magic sign-in link instead of a code that you have the user manually enter into the trusted UI. A phisher would have to get the user to copy-paste the URL from the email into their UI, instead of clicking the link or copy-pas…

offering TOTP MFA auth is important for people who actually keep at least some minimal boundary between their passwords and TOTP seeds.

Re: Emailing a one-time code is worse than passwords

#167

Post by chii »

continuational wrote: post #164
DecoPerson wrote: post #19

The attack pattern is: 1) User goes to BAD website and signs up. 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.” 3) BAD’s bots start a “Sign in with email one-time code” flow on the GOOD website using the user’s email. 4) GOOD sends a one-time login code email to the user’s email address. 5) The user is very likely to trust…

Easy to mitigate by only allowing the device that requested the 6-digit code to use the code. Edit: See first reply, this is not a mitigation at all!

but the device is under the control of BAD. They fake a signin on their backend to GOOD. Your computer never touches GOOD at all, except from seeing the email from GOOD (which you're told about by BAD, and lied to about being a partner signin thing).

The problem being exploited by BAD is that your login account identifier (email in this case) is used in both GOOD (and BAD - accidentally or deliberately orchestrated), and 2-factor does not prevent this type of phishing.

Re: Emailing a one-time code is worse than passwords

#168

Post by apt-apt-apt-apt »

DecoPerson wrote: post #19

The attack pattern is: 1) User goes to BAD website and signs up. 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.” 3) BAD’s bots start a “Sign in with email one-time code” flow on the GOOD website using the user’s email. 4) GOOD sends a one-time login code email to the user’s email address. 5) The user is very likely to trust…

Would it be a viable and simple solution to only enter 6-digit codes into the specific website that requested it?

Isn't this the same thing as BAD asking, let us know the code i.e. password that GOOD gave you? Why would one be inclined to give BAD (i.e. someone else) this info?

Re: Emailing a one-time code is worse than passwords

#170

Post by dchest »

valenterry wrote: post #109
DecoPerson wrote: post #19

The attack pattern is: 1) User goes to BAD website and signs up. 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.” 3) BAD’s bots start a “Sign in with email one-time code” flow on the GOOD website using the user’s email. 4) GOOD sends a one-time login code email to the user’s email address. 5) The user is very likely to trust…

> Passkeys is the way to go No, at least not on its own. Let's not repeat the mistakes. Password managers are the way to go and ONLY FOR RARE EXCEPTIONS we should use dedicated MFA, such as for email-accounts and financial stuff. And the MFA should ask you to set up at least 3 factors and ask you to use 2 or more. And if it doesn't support more or less all factors like printed codes, OS-independent authenticator apps…

If you like password managers, you'll love passkeys!

Passkeys is an interface between your password manager and a website without all the fluff with filling or copy-pasting passwords.

Post reply on HN