Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Emailing a one-time code is worse than passwords

blog.danielh.cc

Post reply on HN
Print view View original

321–330 of 816 posts

Re: Emailing a one-time code is worse than passwords

#321

Post by smallerfish »

johncolanduoni wrote: post #308
uyzstvqs wrote: post #292

Earlier quoted context omitted.

Passkeys are the pinnacle of bad UX. It just works, until the user tries to switch devices, accounts or platforms. The slogan of passkeys should be something like "I don't have a password, it usually just works, but now I changed X and it doesn't work anymore" . Even worse is hardware-based 2FA built into smartphones (also FIDO), as you lose your phone in a lake and now you can't access anything anymore. The way to g…

Apple’s works fine, including when I’m logging on to my windows machine. Opening the camera app is a little annoying, but I don’t have to do it frequently. 1Password works well too and it runs on everything. There’s open source options, but I can’t attest to their UX.

That's fine, but Chrome has 67% market share, and the majority of people will pick the default option for passkeys if prompted. For passkeys to replace passwords it's got to be seamless and easily recoverable without compromising security.

Re: Emailing a one-time code is worse than passwords

#322

Post by 63stack »

johncolanduoni wrote: post #298
t_mann wrote: post #65

Earlier quoted context omitted.

The problems of Passkeys are more nuanced than just losing access when a device is lost (which actually doesn't need to happen depending on your setup). The biggest problem are attestations, which let services block users who use tools that give them more freedom. Passkeys, or more generally challenge-response protocols, could easily have been an amazing replacement for passwords and a win-win for everyone. Unfortuna…

Why would BigTech care about the dozens of users using an open source password manager? What’s their gain from preventing these people from logging in? They love money and don’t care about user freedom, sure. But they’ve shown no evidence of hating user freedom on principle. Every time I’ve seen them actually attack user freedom, there was an embarrassingly obvious business angle. Like Chrome’s browser attestation th…

>Why would BigTech care about the dozens of users using an open source password manager?

Because big tech loves control. Just because you can't see the angle yet, it doesn't mean there isn't one now, or won't be one later. It has been shown time and time again that they will take all the freedom away from you that they can.

Re: Emailing a one-time code is worse than passwords

#323

Post by mschuster91 »

dathinab wrote: post #317

sure, it being a 6 digit code which has potential for social engineering can be an issue like similar to if you get a "your login" yes/no prompt on a authentication app, but a bit less easy to social engineer but a in turn also suspect to bruteforce attacks (similar to how TOTP is suspect to it) through on the other hand - some stuff has so low need of security that it's fine (like configuration site for email news l…

I think you misplaced this comment and it belongs here: https://news.ycombinator.com/item?id=44819917

Re: Emailing a one-time code is worse than passwords

#324

Post by cpcallen »

dathinab wrote: post #317

sure, it being a 6 digit code which has potential for social engineering can be an issue like similar to if you get a "your login" yes/no prompt on a authentication app, but a bit less easy to social engineer but a in turn also suspect to bruteforce attacks (similar to how TOTP is suspect to it) through on the other hand - some stuff has so low need of security that it's fine (like configuration site for email news l…

Did you mean to post this comment at https://news.ycombinator.com/item?id=44819917 ?

Re: Emailing a one-time code is worse than passwords

#325

Post by Urd- »

johnisgood wrote: post #215
jddj wrote: post #108

Earlier quoted context omitted.

In practice it's maybe slightly harder, because they'd have to convince a user to enter their google 2fa code into a site that isn't obviously google? I'd imagine a convincing enough modal would do the trick though, in a lot of cases.

If we are talking about TOTP, there is a time limit to that, which makes it harder, yeah.

Not much harder. The state of the art of phishing right now is proxy based setups like evilginx which pass along credentials in real time. Then you just save the session cookie or change/add the 2fa mechanisms so you can get in whenever you want with the stolen credentials.

Re: Emailing a one-time code is worse than passwords

#326

Post by Urd- »

hulitu wrote: post #162
DecoPerson wrote: post #19

The attack pattern is: 1) User goes to BAD website and signs up. 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.” 3) BAD’s bots start a “Sign in with email one-time code” flow on the GOOD website using the user’s email. 4) GOOD sends a one-time login code email to the user’s email address. 5) The user is very likely to trust…

> Passkeys is the way to go. Password manager support for passkeys is getting really good. And how do you access your password manager when your computer is locked ?

How do you access the phishing site when your computer is locked?

Re: Emailing a one-time code is worse than passwords

#327

Post by ManlyBread »

procaryote wrote: post #148
ManlyBread wrote: post #142

[flagged]

It's correct and to the point. What are you missing?

The author couldn't even be bothered to write about the supposed examples of these practices being wrong. The whole thing lacks detail and actual arguments, instead we get "please stop" like it's some sort of a reddit or twitter shitpost.

Look at this - https://news.ycombinator.com/item?id=44822267 - is this what this site is supposed to be now? Writing the article in the place of the author because the author couldn't be bothered to even form their own argument correctly? What the fuck?

The fact that this has been upvoted so high and allowed to stay on the front page is also a clear signal to others that this low-effort garbage is welcome here, which will only encourage others to post similarly worthless blogposts, lowering the overall quality of this site.

There are multiple comments in this very thread that are longer than this "article". My own comment is longer!

Re: Emailing a one-time code is worse than passwords

#328

Post by growse »

account42 wrote: post #285
growse wrote: post #128

Earlier quoted context omitted.

There's a tension here between "user freedom" and a service wanting to make sure that credentials that it trusts to grant access to stuff aren't just being yolo'd around into textfiles on people's dropboxes. People forget that one of the purposes of authentication is to protect both the end user and the service operator.

What people do on their own computer is none of the service's business.

It is if it puts the service at risk.

Re: Emailing a one-time code is worse than passwords

#329

Post by yunwal »

smallerfish wrote: post #321
johncolanduoni wrote: post #308

Earlier quoted context omitted.

Apple’s works fine, including when I’m logging on to my windows machine. Opening the camera app is a little annoying, but I don’t have to do it frequently. 1Password works well too and it runs on everything. There’s open source options, but I can’t attest to their UX.

That's fine, but Chrome has 67% market share, and the majority of people will pick the default option for passkeys if prompted. For passkeys to replace passwords it's got to be seamless and easily recoverable without compromising security.

> the majority of people will pick the default option for passkeys if prompted

Especially since Google doesn’t allow you to change your personal default which is what convinced me to go and switch all my accounts off of Google SSO

Re: Emailing a one-time code is worse than passwords

#330

Post by bryanrasmussen »

johncolanduoni wrote: post #298
t_mann wrote: post #65

Earlier quoted context omitted.

The problems of Passkeys are more nuanced than just losing access when a device is lost (which actually doesn't need to happen depending on your setup). The biggest problem are attestations, which let services block users who use tools that give them more freedom. Passkeys, or more generally challenge-response protocols, could easily have been an amazing replacement for passwords and a win-win for everyone. Unfortuna…

Why would BigTech care about the dozens of users using an open source password manager? What’s their gain from preventing these people from logging in? They love money and don’t care about user freedom, sure. But they’ve shown no evidence of hating user freedom on principle. Every time I’ve seen them actually attack user freedom, there was an embarrassingly obvious business angle. Like Chrome’s browser attestation th…

>Why would BigTech care about the dozens of users using an open source password manager?

I agree, why would BigTech care about those dozens of users. Screw those guys, they can use our password manager or they can get lost, we don't need them!

Post reply on HN