Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Emailing a one-time code is worse than passwords

blog.danielh.cc

Post reply on HN
Print view View original

271–280 of 816 posts

Re: Emailing a one-time code is worse than passwords

#271

Post by florieger »

DecoPerson wrote: post #19

The attack pattern is: 1) User goes to BAD website and signs up. 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.” 3) BAD’s bots start a “Sign in with email one-time code” flow on the GOOD website using the user’s email. 4) GOOD sends a one-time login code email to the user’s email address. 5) The user is very likely to trust…

How is it worse than using a password? I think I'm missing something, please explain.

1) User goes to BAD website.

2) BAD website says “Please enter your email and password”.

3) BAD’s bots start a “Log in with email and password” on the GOOD website using the user’s email and password.

4) BAD now has full access to the user’s GOOD account.

Re: Emailing a one-time code is worse than passwords

#272

Post by charcircuit »

j1elo wrote: post #251
charcircuit wrote: post #233

Earlier quoted context omitted.

You can add the new phone as an additional passkey. I don't see how this would be scary.

I have 531 logins for varied websites and services. Would you enjoy having to change 531 passkey devices? Me neither. But default login flows in all these sites prompt you to use your current device as passkey by default, so people who don't know better (i.e. a general "everybody") are being gently pushed to do so.

No, which is why there is the cross platform standard CXF which allows for cross platform sharing of passkeys. Apple has announced that support for this is shipping later this year with iOS 26. Google hasn't announced when they are shipping it yet.

Re: Emailing a one-time code is worse than passwords

#273

Post by netcan »

DecoPerson wrote: post #19

The attack pattern is: 1) User goes to BAD website and signs up. 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.” 3) BAD’s bots start a “Sign in with email one-time code” flow on the GOOD website using the user’s email. 4) GOOD sends a one-time login code email to the user’s email address. 5) The user is very likely to trust…

Good points but dont underestimate "granny needs to visit the bank to get access to her account again" as a problem.

For a lot of people, dealing with (now mostly digital) bureaucracies is a major stress in life. The biggest one, for some.

Its not just about invonvenience. Its sometimes about losing access to some, and just not having it for a while.

In terms of practical effect, a performance metric for a login system could be "% of users that have access at a given point." There can be a real tradeoff, irl, between legitimate access and security.

On the vendor side.. the one time passwords fallback has become a primary login method for some. Especially government websites.

Customer support is costly and limited in capacity. We are just worse at this than we used to be.

Digital identity is turning out to be a generational problem.

Re: Emailing a one-time code is worse than passwords

#274

Post by michaelsshaw »

florieger wrote: post #271
DecoPerson wrote: post #19

The attack pattern is: 1) User goes to BAD website and signs up. 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.” 3) BAD’s bots start a “Sign in with email one-time code” flow on the GOOD website using the user’s email. 4) GOOD sends a one-time login code email to the user’s email address. 5) The user is very likely to trust…

How is it worse than using a password? I think I'm missing something, please explain. 1) User goes to BAD website. 2) BAD website says “Please enter your email and password”. 3) BAD’s bots start a “Log in with email and password” on the GOOD website using the user’s email and password. 4) BAD now has full access to the user’s GOOD account.

Password managers can catch this case by not autofilling, hinting the user to take a step back and pay attention.

Re: Emailing a one-time code is worse than passwords

#275

Post by Hnrobert42 »

smallerfish wrote: post #241
DecoPerson wrote: post #19

The attack pattern is: 1) User goes to BAD website and signs up. 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.” 3) BAD’s bots start a “Sign in with email one-time code” flow on the GOOD website using the user’s email. 4) GOOD sends a one-time login code email to the user’s email address. 5) The user is very likely to trust…

> Passkeys is the way to go. Password manager support for passkeys is getting really good. I set up a passkey for github at some point, and apparently saved it in Chrome. When I try to "use passkey for auth" with github, I get a popup from Chrome asking me to enter my google password manager's pin. I don't know what that pin is. I have no way of resetting that pin - there's nothing about the pin in my google profile,…

That is unfortunate, but that sounds more like a chrome problem than a passkey problem. You would have the same issue if chrome saved your password.

Re: Emailing a one-time code is worse than passwords

#276

Post by charcircuit »

zekica wrote: post #268
charcircuit wrote: post #255

Earlier quoted context omitted.

Reducing passkeys to the security level of passwords is not just "making something user friendly". It's undoing all of the hardware everyone else in the ecosystem is putting into to making a more secure way for authentication to be done.

How exactly is this "reducing the security level to those of passwords"? For example: you can't use a passkey on attacker's web site even if you have a plaintext copy of the private key.

I'm not following. The issue is about it being used for the site the private key is for. The attacker's site is irrelevant here.

Re: Emailing a one-time code is worse than passwords

#277

Post by varunramesh »

As the author points out, email OTP can be phished if the user is tricked into sending their OTP to an attacker.

Email magic links are more phishing resistant - the email contains a link that authenticates the device where the link was clicked. To replicate the same attack, the user would have to send the entire link to the attacker, which is hopefully harder to socially engineer.

But magic links are annoying when I want to sign in from my desktop computer that doesn't have access to my email. In that case OTP is more convenient, since I can just read the code from my phone.

I think passkeys are a great option. I use a password manager for passkeys, but most people will use platform-provided keys that are stuck in one ecosystem (Google/Apple/MS). You probably need a way to register a new device, which brings you back again to email OTP or magic link (even if only as an account recovery option).

Re: Emailing a one-time code is worse than passwords

#278

Post by Someone »

florieger wrote: post #271
DecoPerson wrote: post #19

The attack pattern is: 1) User goes to BAD website and signs up. 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.” 3) BAD’s bots start a “Sign in with email one-time code” flow on the GOOD website using the user’s email. 4) GOOD sends a one-time login code email to the user’s email address. 5) The user is very likely to trust…

How is it worse than using a password? I think I'm missing something, please explain. 1) User goes to BAD website. 2) BAD website says “Please enter your email and password”. 3) BAD’s bots start a “Log in with email and password” on the GOOD website using the user’s email and password. 4) BAD now has full access to the user’s GOOD account.

People hopefully won’t reuse the username/password they use on GOOD to log into BAD, so the login that BAD does in step 3 will fail.

Re: Emailing a one-time code is worse than passwords

#279

Post by southp »

I get the point. However, from my own experience this type of one-time passcode is unfortunately the 2nd well-understood authentication method for non-tech people surrounding me. The 1st is the password, of course.

I don't know the general situation, but, at least in our small town, people would go to the phone service shop just for account setup and recovery, since it's just too complicated. Password managers and passkeys don't make things simpler for them either –– I've never successfully conveyed the idea of a password manager to a non-tech person; the passkey is somehow even harder to explain. From my perspective it's both the mental model and the extra, convoluted UX that's very hard to grasp for them.

Until one day we come up with something intuitive for general audience, passwords and the "worse" one-time code will likely continue to be prominent for their simplicity.

Re: Emailing a one-time code is worse than passwords

#280

Post by Stratoscope »

I can't be the only person here who is familiar with the word "attestation" in everyday life but had no idea what it means in the context of login security.

So I asked my friend Miss Chatty [1] about it. Hopefully this will help anyone who is as confused as I was.

https://chatgpt.com/share/68947f35-0a10-8012-9ae9-adadc3df8b...

[1] Siri and Alexa get to have cool names, so why can't ChatGPT?

Post reply on HN