Anthropic/Claude does this and it is a shame. They have the ability to code proper Authenticator and yet don’t.
[insert joke about vibe coding a shit auth service]
Emailing a one-time code is worse than passwords
201–210 of 816 posts
Re: Emailing a one-time code is worse than passwords
#202Wholeheartedly agree, however The Changelog Podcast helped shift my perspective on this. It's really about not having the responsibility of storing and maintaining passwords.
I feel like this is going to bite me in the ass 15 years from now but like bcrypt is really really hard to screw up
Latacora, 2018: In order of preference, use scrypt, argon2, bcrypt, and then if nothing else is available PBKDF2.
So even 7 years ago bcrypt was only the 3rd recommended option.
Re: Emailing a one-time code is worse than passwords
#203Earlier quoted context omitted.
That's still not perfect though! Most leaked passwords online come initially from leaked hashes, which bad actors use tools like hashcat to crack. If your user has a password like "password123" and the hash gets out, then the password is effectively out too, since people can easily lookup the hash of previous cracked passwords like "password123".
No. This is why salts[0] are used. [0] https://en.wikipedia.org/wiki/Salt_(cryptography)
This is how it should be done. But it still doesn't protect users fully, because attacker can try to brute-force passwords their interested in. It requires much more effort though.
Re: Emailing a one-time code is worse than passwords
#204The attack pattern is: 1) User goes to BAD website and signs up. 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.” 3) BAD’s bots start a “Sign in with email one-time code” flow on the GOOD website using the user’s email. 4) GOOD sends a one-time login code email to the user’s email address. 5) The user is very likely to trust…
> Passkeys is the way to go. I wish there was a stronger differentiation between syncable and device-bound passkeys. It seems like we're now using the same word for two approaches which are very different when it comes to security and user-friendliness. And yes, giving granny unsyncable passkeys is a really bad idea, for so many reasons.
> I wish there was a stronger differentiation between syncable and device-bound passkeys.
But there is no difference. I'd prefer if services just let me generate a passkey and leave it entirely up to me how I manage it. Whoever setup granny's device should have done so with a cloud based manager.
I think Google tries to make some confused distinction, or maybe that has more to do with FIDO U2F vs FIDO2. There you can add either a "passkey" or a "security key", but iirc I added my passkey on my security key so... yeah
Re: Emailing a one-time code is worse than passwords
#205Very short, badly written article. It can't even describe phishing correctly... At least label your threat model correctly. While the premise is correct -- it's easy to complain but the author also provides zero recommendations on what is a better form of MFA.
You misread the short article. It's about email as single factor auth, which has become very trendy of late. You just enter your email address, no password, and the email you a code. Access to your email is the only authentication.
But then, email always was the only authentication. On any site, click "forgot password" and promptly they send you a reset password link. Very few sites have a challenge question.
Re: Emailing a one-time code is worse than passwords
#206One additional annoyance with this type of login:
With a username and password field, these are automatically correctly filled by Safari.
With sites that only offer an email field, I have to manually fill it.
(Note that I tend to use different emails for different sites; if you only ever use one email this might not be a problem).
Re: Emailing a one-time code is worse than passwords
#207Earlier quoted context omitted.
Do you have some examples where people actually require attestation in 3rd party facing systems? Or is this purely "But in theory..." and you've dismissed all the very real problems with the alternatives because you're scared of a theoretical problem ? I always reject attestation requests and I don't recall ever having been refused, so if this was a real problem it seems like I ought to have noticed by now.
Passkeys are in their infancy. You don't go about rolling out such patterns when most users haven't even switched yet and big players like Apple are still resisting attestations (last time I checked). The problem is that the feature is there and can be (ab)-used in this way, so it should be rejected on principle, irrespective of whether it's a problem right now . I understand the value of attestations in a corporate…
Apple hasn't been particularly resistant to offering device attestation. The DeviceCheck / App Attest system has been offered since iOS 11 released in 2017. https://developer.apple.com/documentation/devicecheck
Re: Emailing a one-time code is worse than passwords
#208I read this sentence 4 times and I still can't parse it:
> An attacker can simply send your email address to a legitimate service, and prompt for a 6-digit code. You can't know for sure if the code is supposed to be entered in the right place.
Re: Emailing a one-time code is worse than passwords
#209Earlier quoted context omitted.
Two problems I’ve encountered with magic links: * Mobile email clients that open links in an embedded browser. This confuses some people. From their perspective they never stay logged in, because every time they open their regular browser they don’t have a session (because it was created in the embedded browser) and have to request a login link again. * Some people don’t have their email on the device they want to lo…
Magic links can be used to authorize the session rather than the device. That is, starting the sign in process on your laptop and clicking the link on your phone would authorize your laptop's sign in request rather than your phone's browser. It requires a bit more effort but it's not especially difficult to do.
This is what makes securing this stuff so hard when you don't have proper review. What seems like a good idea from one perspective opens up another gaping hole somewhere else.
Off the cuff suggestions for improving UX in secure flows just make things worse.
Re: Emailing a one-time code is worse than passwords
#210It's also a lot less convenient. Because I need to have access to my email, wait for the code, copy it etc. I hate companies that dump this extra work on me, like booking.com and all the AI companies.
Passkeys would be so much easier, convenient and so much more secure. I really don't understand why they go for this.