Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Emailing a one-time code is worse than passwords

blog.danielh.cc

Post reply on HN
Print view View original

281–290 of 816 posts

Re: Emailing a one-time code is worse than passwords

#281

Post by Hnrobert42 »

Lukas_Skywalker wrote: post #132
iEchoic wrote: post #112

Four times a day, I get an email notification that someone requested a password reset for my Microsoft account, which gives me a six-digit number to recover my account. So every day, an attacker has four shots in 1,000,000 of stealing my account by just guessing the number. They've been doing this for years. If the attacker's doing this to thousands of accounts - which I'm sure they are - they're going to be stealing…

I have added what I think they call login alias to my account. This blocks logins using the normal account username (which is my public email address), and only allows them via the alias (which is not public and just a random string). Not a single foreign login attempt since I enabled the alias. You can enable it on account.microsoft.com > Account Info > Sign-in preferences > Add email > Add Alias and make it primary…

Then, is the login alias sort of a password? In that, it is something you know.

Re: Emailing a one-time code is worse than passwords

#282

Post by jaggirs »

florieger wrote: post #271
DecoPerson wrote: post #19

The attack pattern is: 1) User goes to BAD website and signs up. 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.” 3) BAD’s bots start a “Sign in with email one-time code” flow on the GOOD website using the user’s email. 4) GOOD sends a one-time login code email to the user’s email address. 5) The user is very likely to trust…

How is it worse than using a password? I think I'm missing something, please explain. 1) User goes to BAD website. 2) BAD website says “Please enter your email and password”. 3) BAD’s bots start a “Log in with email and password” on the GOOD website using the user’s email and password. 4) BAD now has full access to the user’s GOOD account.

In your example, the user is logging in to BAD.com, thinking it is GOOD.com.

In the OP's example, the user is logging in to BAD.com intentionally, but his GOOD.com account is still hacked into.

This is a lot harder for the user to catch on to.

Re: Emailing a one-time code is worse than passwords

#283

Post by Yeul »

roelschroeven wrote: post #232
ramraj07 wrote: post #219

Earlier quoted context omitted.

I know not to click links on random emails but comfortably click links on emails I initiated from a website.

How do you know the email comes from that website? There are known cases of phishing mails being sent when people expect a legitimate mail.

If someone hacks my account and starts ordering stuff on bol it's not my problem but the company's so I don't sleep over it.

The company doesn't care either because fraud is just the cost of doing business- ease of ordering> security.

Re: Emailing a one-time code is worse than passwords

#284

Post by dspillett »

And even if proper passwords are used, many sites/apps use this pattern for account recovery if the password is forgotten so effectively this is the only security as an attacker has “forgotten” the password and just uses this flow to login.

I've got a little generic login tool that bits I write myself use for login, using this method, but it is not for anything sensitive or otherwise important (I just want to identify the user, myself or a friend, so correct preferences and other saved information can be applied to the right person, and the information is not easily scraped) - I call it ICGAFAS, the “I Couldn't Give A Factor” Auth System to make it obvious how properly secure it isn't trying to be!

Another issue that email based “authentication” like this (though one for the site/app admins more than the end user) has is the standard set of deliverability issues inherent with modern handling of SMTP mail. You end up having to use a 3rd party relay service to reduce the amount of time you spend fighting blocklists as your source address gets incorrectly ignored as a potential spam source.

Re: Emailing a one-time code is worse than passwords

#285

Post by account42 »

growse wrote: post #128
t_mann wrote: post #105

Earlier quoted context omitted.

I agree, but unfortunately the spec authors are already going out and dangling possible bans in front of projects who implement Passkeys in more user-friendly ways: https://github.com/keepassxreboot/keepassxc/issues/10407 > To be very honest here, you risk having KeePassXC blocked by relying parties But having a choice about how you store your credentials shouldn't depend on the good faith of service providers or the…

There's a tension here between "user freedom" and a service wanting to make sure that credentials that it trusts to grant access to stuff aren't just being yolo'd around into textfiles on people's dropboxes. People forget that one of the purposes of authentication is to protect both the end user and the service operator.

What people do on their own computer is none of the service's business.

Re: Emailing a one-time code is worse than passwords

#286

Post by __MatrixMan__ »

DecoPerson wrote: post #19

The attack pattern is: 1) User goes to BAD website and signs up. 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.” 3) BAD’s bots start a “Sign in with email one-time code” flow on the GOOD website using the user’s email. 4) GOOD sends a one-time login code email to the user’s email address. 5) The user is very likely to trust…

Passkeys will be the way to go if we get them to remove the "attestation object" field from the protocol. Until then there's no way for Jimbob to tell the difference between:

> Website: is this Jimbob' phone

> Hardware: yes

And

> Website: I'll give you a dollar if you tell me something juicy about this user

> Hardware: Give this token to Microsoft and ask them

> Microsoft: Jimbob is most likely to click ads involving fancy cheeses, is sympathetic to LGBTQ causes, and attended a protest last week

With passwords and TOTP codes, I am in control of what information is exchanged. Passkeys create a channel that I can't control and which will be used against me.

(I chose Microsoft here because in a few months they're using the windows 10->11 transition to force people into hardware that locks the user out of this conversation, though surely others will also be using passkeys for similarly shady things).

Re: Emailing a one-time code is worse than passwords

#287

Post by account42 »

charcircuit wrote: post #247
sam_lowry_ wrote: post #129

Earlier quoted context omitted.

The exact point of passkeys is to remove all rights from users )

Ensuring it's not possible for remote attackers to easily steal users passkeys is not "removing all rights" for someone. It is setting a security bar you have to pass. One user's poor security can have negative effects on not just them but the platform itself.

You don't need attestation to allow users to secure their passwords.

Re: Emailing a one-time code is worse than passwords

#288

Post by account42 »

dchest wrote: post #170
valenterry wrote: post #109

Earlier quoted context omitted.

> Passkeys is the way to go No, at least not on its own. Let's not repeat the mistakes. Password managers are the way to go and ONLY FOR RARE EXCEPTIONS we should use dedicated MFA, such as for email-accounts and financial stuff. And the MFA should ask you to set up at least 3 factors and ask you to use 2 or more. And if it doesn't support more or less all factors like printed codes, OS-independent authenticator apps…

If you like password managers, you'll love passkeys! Passkeys is an interface between your password manager and a website without all the fluff with filling or copy-pasting passwords.

Also without all that pesky privacy and choice of what you run on your own computer.

Re: Emailing a one-time code is worse than passwords

#289

Post by dada78641 »

DecoPerson wrote: post #19

The attack pattern is: 1) User goes to BAD website and signs up. 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.” 3) BAD’s bots start a “Sign in with email one-time code” flow on the GOOD website using the user’s email. 4) GOOD sends a one-time login code email to the user’s email address. 5) The user is very likely to trust…

This is a 100x better explanation than what's in the blog post. The blog post is practically a tweet.

Re: Emailing a one-time code is worse than passwords

#290

Post by account42 »

jaggirs wrote: post #282
florieger wrote: post #271

Earlier quoted context omitted.

How is it worse than using a password? I think I'm missing something, please explain. 1) User goes to BAD website. 2) BAD website says “Please enter your email and password”. 3) BAD’s bots start a “Log in with email and password” on the GOOD website using the user’s email and password. 4) BAD now has full access to the user’s GOOD account.

In your example, the user is logging in to BAD.com, thinking it is GOOD.com. In the OP's example, the user is logging in to BAD.com intentionally, but his GOOD.com account is still hacked into. This is a lot harder for the user to catch on to.

Specifically, that OP describes sounds like a plausible log-in-with-big-tech-company flow that is really common these days.
Post reply on HN