Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Emailing a one-time code is worse than passwords

blog.danielh.cc

Post reply on HN
Print view View original

381–390 of 816 posts

Re: Emailing a one-time code is worse than passwords

#381

Post by emushack »

doublerabbit wrote: post #246
pyrale wrote: post #158

Earlier quoted context omitted.

We need to go further. If a service doesn't include 197 factors including blood samples, showing up at a physical location 50 miles from your home, and sending a picture of yourself in a specific posture, and doesn't require you to use at least 53 of them (determined randomly) to login, then it's insecure and should not be used.

Sounds like something the UK gov would love to implement, plus extra. Such as finding a dinosaur fossil of your families name clan.

And then we can compress all of that into a single piece of plastic and call it the Ident-i-eeze.

Re: Emailing a one-time code is worse than passwords

#382

Post by oidar »

johncolanduoni wrote: post #308
uyzstvqs wrote: post #292

Earlier quoted context omitted.

Passkeys are the pinnacle of bad UX. It just works, until the user tries to switch devices, accounts or platforms. The slogan of passkeys should be something like "I don't have a password, it usually just works, but now I changed X and it doesn't work anymore" . Even worse is hardware-based 2FA built into smartphones (also FIDO), as you lose your phone in a lake and now you can't access anything anymore. The way to g…

Apple’s works fine, including when I’m logging on to my windows machine. Opening the camera app is a little annoying, but I don’t have to do it frequently. 1Password works well too and it runs on everything. There’s open source options, but I can’t attest to their UX.

Apple's works fine until you don't have access to your apple devices.

Re: Emailing a one-time code is worse than passwords

#383

Post by lanfeust6 »

Lukas_Skywalker wrote: post #132
iEchoic wrote: post #112

Four times a day, I get an email notification that someone requested a password reset for my Microsoft account, which gives me a six-digit number to recover my account. So every day, an attacker has four shots in 1,000,000 of stealing my account by just guessing the number. They've been doing this for years. If the attacker's doing this to thousands of accounts - which I'm sure they are - they're going to be stealing…

I have added what I think they call login alias to my account. This blocks logins using the normal account username (which is my public email address), and only allows them via the alias (which is not public and just a random string). Not a single foreign login attempt since I enabled the alias. You can enable it on account.microsoft.com > Account Info > Sign-in preferences > Add email > Add Alias and make it primary…

This is what I do. The crucial thing is to only use the alias for logging in.

Re: Emailing a one-time code is worse than passwords

#384

Post by anonymars »

Uvix wrote: post #347
al_borland wrote: post #344

Earlier quoted context omitted.

Isn’t clicking on a link in an email also problematic? It gets users in the habit of trusting links in emails. There is a history of those being used in bad ways as well. I still don’t really understand what recovery looks like for a lost passkey… especially if I lose all of them. Not everything has a physical location where an identity can be validated, like a bank. Even my primary bank isn’t local. I’d have to driv…

The recovery of a lost passkey is the same as a lost password.

How often do you lose the password for every account you have simultaneously?

Re: Emailing a one-time code is worse than passwords

#385

Post by KingOfCoders »

DecoPerson wrote: post #19

The attack pattern is: 1) User goes to BAD website and signs up. 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.” 3) BAD’s bots start a “Sign in with email one-time code” flow on the GOOD website using the user’s email. 4) GOOD sends a one-time login code email to the user’s email address. 5) The user is very likely to trust…

Please log into BAD.com - we're a login provider to GOOD.com with a higher security level, from now on use BAD.com to log into GOOD.com

Why would I put a secret code from GOOD.com into BAD.com? That's the core of the problem.

If you put a code you get from GOOD.com into BAD.com, it's like you put a password from GOOD.com into BAD.com - don't do that.

Re: Emailing a one-time code is worse than passwords

#386

Post by aembleton »

probably_wrong wrote: post #222
klipt wrote: post #118

Earlier quoted context omitted.

> I’d rather granny needs to visit the bank to get access to her account again Visiting the bank is fine. But who do you visit to recover your Gmail password?

For the record, if you're in the EU you can make a GDPR request to their Data Protection Officer - since it's your data what's being kept away from you, you have the right to at least a backup. It can take months and it only guarantees a backup, not full access, but it's better than nothing.

How would you prove to their data protection officer that you are the owner of that Gmail account?

Re: Emailing a one-time code is worse than passwords

#387

Post by growse »

AlexandrB wrote: post #364
growse wrote: post #328

Earlier quoted context omitted.

It is if it puts the service at risk.

This attitude has got to stop. Is it not enough that there's no customer service and it's almost impossible to sue these companies thanks to arbitration clauses? Now they need to have control over our computing to keep themselves safe? And how many recorded incidents of losing an account because someone had their "password in a text file" are even out there? The most common scenarios one hears about are either phishi…

Do you think someone running a service that's under constant denial-of-service attacks would be sympathetic to the argument that "What people do on their own computer is none of the service's business".

Pretty much every service out there has "don't share credentials" in their ToU. You don't have to like it, but you also don't have to accept the ToU.

Re: Emailing a one-time code is worse than passwords

#388

Post by sam_lowry_ »

charcircuit wrote: post #371
account42 wrote: post #287

Earlier quoted context omitted.

You don't need attestation to allow users to secure their passwords.

You don't, but with one services have a better guarantee that they are.

Services, by definition, serve. Why should we, the users, care about their guarantees?

Re: Emailing a one-time code is worse than passwords

#389

Post by blkhawk »

codedokode wrote: post #373
valenterry wrote: post #109

Earlier quoted context omitted.

> Passkeys is the way to go No, at least not on its own. Let's not repeat the mistakes. Password managers are the way to go and ONLY FOR RARE EXCEPTIONS we should use dedicated MFA, such as for email-accounts and financial stuff. And the MFA should ask you to set up at least 3 factors and ask you to use 2 or more. And if it doesn't support more or less all factors like printed codes, OS-independent authenticator apps…

Password managers are those proprietary programs that you need to install, give full access to your computer, register an account and trust their word that your passwords are uploaded to the cloud securely? No thanks. Also they are too complicated for an ordinary user. A physical key is much simpler and doesn't require any setup or thinking, and can be used on multiple devices without any configuration. And doesn't r…

uh no - a password manager is an open source application you can compile and install yourself if you want. Its nothing more than a small specialised database with a excel like interface. Personally I think that the argument that things are "too complicated for the average user" eventually gets gets you users that find breathing and sphincter function too complicated.

Re: Emailing a one-time code is worse than passwords

#390

Post by tsimionescu »

growse wrote: post #128
t_mann wrote: post #105

Earlier quoted context omitted.

I agree, but unfortunately the spec authors are already going out and dangling possible bans in front of projects who implement Passkeys in more user-friendly ways: https://github.com/keepassxreboot/keepassxc/issues/10407 > To be very honest here, you risk having KeePassXC blocked by relying parties But having a choice about how you store your credentials shouldn't depend on the good faith of service providers or the…

There's a tension here between "user freedom" and a service wanting to make sure that credentials that it trusts to grant access to stuff aren't just being yolo'd around into textfiles on people's dropboxes. People forget that one of the purposes of authentication is to protect both the end user and the service operator.

What does Microsoft stand to lose if someone steals my passkey for Outlook from a text file I yolo'd into a Dropbox?
Post reply on HN