Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Emailing a one-time code is worse than passwords

blog.danielh.cc

Post reply on HN
Print view View original

221–230 of 816 posts

Re: Emailing a one-time code is worse than passwords

#221

Post by Cthulhu_ »

ramraj07 wrote: post #219
roelschroeven wrote: post #194

Earlier quoted context omitted.

> “Click a link in the email” is a tiny bit better because it takes the user straight to the GOOD website, and passing that link to BAD is more tedious and therefore more suspicious. "Click a link in the email" is really bad because it's very difficult to know the mail and the link in it are legitimate. Trusting links in emails opens to door to phishing attacks.

I know not to click links on random emails but comfortably click links on emails I initiated from a website.

You do, but does the average user? Security's reliance on people's behaviour / knowledge / discipline should be minimal.

Re: Emailing a one-time code is worse than passwords

#222

Post by probably_wrong »

klipt wrote: post #118
DecoPerson wrote: post #19

The attack pattern is: 1) User goes to BAD website and signs up. 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.” 3) BAD’s bots start a “Sign in with email one-time code” flow on the GOOD website using the user’s email. 4) GOOD sends a one-time login code email to the user’s email address. 5) The user is very likely to trust…

> I’d rather granny needs to visit the bank to get access to her account again Visiting the bank is fine. But who do you visit to recover your Gmail password?

For the record, if you're in the EU you can make a GDPR request to their Data Protection Officer - since it's your data what's being kept away from you, you have the right to at least a backup.

It can take months and it only guarantees a backup, not full access, but it's better than nothing.

Re: Emailing a one-time code is worse than passwords

#223

Post by druskacik »

bscphil wrote: post #113
tczMUFlmoNk wrote: post #14

Earlier quoted context omitted.

I think this means: 1. You go to evil.example.com, which uses this flow. 2. It prompts you to enter your email. You do so, and you receive a code. 3. You enter the code at evil.example.com. 4. But actually what the evil backend did was automated a login attempt to, like, Shopify or some other site that also uses this pattern. You entered their code on evil.example.com. Now the evil backend has authenticated to Shopif…

The site is comparing this method to plain username + password though. Doesn't that miss the obvious point that evil.example.com could do the exact same thing with the username + password method, except it's even easier to phish because they just get your username + password directly (when you type them in) and then an attacker can log in as you via a real browser?

evil.example.com can be a legitimate-looking website (e.g. a new tool a person might want to try). If it has a login with email code, it can try to get the code from a different website (e.g. aforementioned Shopify).

For the username + password hack to work, the evil.example.com would have to look like Shopify, which is definitely more suspicious than if it's just a random legitimate-looking website.

Re: Emailing a one-time code is worse than passwords

#225

Post by WithinReason »

DecoPerson wrote: post #19

The attack pattern is: 1) User goes to BAD website and signs up. 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.” 3) BAD’s bots start a “Sign in with email one-time code” flow on the GOOD website using the user’s email. 4) GOOD sends a one-time login code email to the user’s email address. 5) The user is very likely to trust…

you can to the same with text messages, right? That's even more scary.

Re: Emailing a one-time code is worse than passwords

#226

Post by Perz1val »

avodonosov wrote: post #218
DecoPerson wrote: post #19

The attack pattern is: 1) User goes to BAD website and signs up. 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.” 3) BAD’s bots start a “Sign in with email one-time code” flow on the GOOD website using the user’s email. 4) GOOD sends a one-time login code email to the user’s email address. 5) The user is very likely to trust…

The scheme is impossible, because the GOOD site says in the email "NEVER SHARE THIS ONE TIME CODE WITH 3RD PARTY APPS OR INDIVIDUALS"

Phising = pretending you're the first party

Re: Emailing a one-time code is worse than passwords

#228

Post by dchest »

Flimm wrote: post #220
valenterry wrote: post #178

Earlier quoted context omitted.

No need to write like that. I know, understand and use passkeys for quite a while now. I don't love them. I don't love passwords either. But while I don't fear passwords, I fear passkeys. The reason is that it makes the tech even more intransparent. My password manager stops working, completely dies or I can't use it anymore for other reason? No problem, I can fallback to a paper list of passwords if I really have to…

What about server-generated passwords, like API keys? That would solve the main problem with passwords, namely, that people reuse the same weak password everywhere. I doubt it would be as popular as user-selected passwords, but I still wonder why no website has tried it.

How is that different from a passkey's private key, apart from being less secure?

It's literally something like

  hnkTKS7h2WCOBr3CxSKM51cSVKSkiKOSlQsMhtRZ0CU
stored in the password manager.

Re: Emailing a one-time code is worse than passwords

#230

Post by Fargren »

DecoPerson wrote: post #19

The attack pattern is: 1) User goes to BAD website and signs up. 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.” 3) BAD’s bots start a “Sign in with email one-time code” flow on the GOOD website using the user’s email. 4) GOOD sends a one-time login code email to the user’s email address. 5) The user is very likely to trust…

I don't see how that's worse than user-password authentication. For password without 2FA the attack pattern is

1) User goes to BAD website and signs up (with their user and password). BAD website captures the user and password

2) BAD website shows a fake authentication error, and redirects to GOOD website. Users is not very likely to notice.

3) BAD uses user and password to login to GOOD’s website as the user. BAD now has full access to the user’s GOOD account.

OK, with a password manager the user is more likely to notice they are in BAD website. Is that the advantage?

Post reply on HN