Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Emailing a one-time code is worse than passwords

blog.danielh.cc

Post reply on HN
Print view View original

391–400 of 816 posts

Re: Emailing a one-time code is worse than passwords

#391

Post by Lukas_Skywalker »

Hnrobert42 wrote: post #281
Lukas_Skywalker wrote: post #132

Earlier quoted context omitted.

I have added what I think they call login alias to my account. This blocks logins using the normal account username (which is my public email address), and only allows them via the alias (which is not public and just a random string). Not a single foreign login attempt since I enabled the alias. You can enable it on account.microsoft.com > Account Info > Sign-in preferences > Add email > Add Alias and make it primary…

Then, is the login alias sort of a password? In that, it is something you know.

In a way, yes. I don't count on it being private though. But it appears nowhere online, so it's not used by credential stuffers or other bots.

Re: Emailing a one-time code is worse than passwords

#392

Post by growse »

nyeah wrote: post #360
growse wrote: post #357

Earlier quoted context omitted.

I don't know what "scare quotes" are. They're just regular quotation marks, because I'm quoting.

Sure, I stand corrected, you "don't know" what I'm talking about.

Literally no idea.

My point was that freedom is not an absolute, it's balanced against other freedoms. It's hard to tell whether you agree with that or not.

Re: Emailing a one-time code is worse than passwords

#394

Post by FuriouslyAdrift »

t_mann wrote: post #65
DecoPerson wrote: post #19

The attack pattern is: 1) User goes to BAD website and signs up. 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.” 3) BAD’s bots start a “Sign in with email one-time code” flow on the GOOD website using the user’s email. 4) GOOD sends a one-time login code email to the user’s email address. 5) The user is very likely to trust…

The problems of Passkeys are more nuanced than just losing access when a device is lost (which actually doesn't need to happen depending on your setup). The biggest problem are attestations, which let services block users who use tools that give them more freedom. Passkeys, or more generally challenge-response protocols, could easily have been an amazing replacement for passwords and a win-win for everyone. Unfortuna…

We've had massive problems with moving to passkeys (browser based) at our company and moved back to an app based Authenticator. Everyone is accepting of the autenticator app or uses a yubikey.

Re: Emailing a one-time code is worse than passwords

#395

Post by bradleyankrom »

iEchoic wrote: post #112

Four times a day, I get an email notification that someone requested a password reset for my Microsoft account, which gives me a six-digit number to recover my account. So every day, an attacker has four shots in 1,000,000 of stealing my account by just guessing the number. They've been doing this for years. If the attacker's doing this to thousands of accounts - which I'm sure they are - they're going to be stealing…

I get a similar message constantly for an old Instagram account - "sorry you're having trouble logging in, click here to log in and change your password!"

Re: Emailing a one-time code is worse than passwords

#396

Post by ramses0 »

Hnrobert42 wrote: post #281
Lukas_Skywalker wrote: post #132

Earlier quoted context omitted.

I have added what I think they call login alias to my account. This blocks logins using the normal account username (which is my public email address), and only allows them via the alias (which is not public and just a random string). Not a single foreign login attempt since I enabled the alias. You can enable it on account.microsoft.com > Account Info > Sign-in preferences > Add email > Add Alias and make it primary…

Then, is the login alias sort of a password? In that, it is something you know.

joe@smith.com, joe.smith@bigcompany.com

...those will get "drive by" attacks no matter what.

Interesting that they're letting you alias it back to "coolkid5674321" again...

Re: Emailing a one-time code is worse than passwords

#397

Post by growse »

eredengrin wrote: post #180
growse wrote: post #128

Earlier quoted context omitted.

There's a tension here between "user freedom" and a service wanting to make sure that credentials that it trusts to grant access to stuff aren't just being yolo'd around into textfiles on people's dropboxes. People forget that one of the purposes of authentication is to protect both the end user and the service operator.

Sure, but as long as the fallback for account recovery is sending a reset email or sms (both of which are similar or worse than yoloing textfiles on dropboxes), that's a very tough argument to make in good faith.

I agree that account recovery isn't the best. But just because that sucks doesn't mean there's zero value in improving credentials.

Re: Emailing a one-time code is worse than passwords

#398

Post by jerf »

valenterry wrote: post #181
degamad wrote: post #150

Earlier quoted context omitted.

Passkey are more like password managers, and less like MFA tokens - despite the fact that many passkey implementations can function as MFA tokens as well. Bitwarden the password manager includes a full passkey implementation, which doesn't involve any MFA.

> Passkey are more like password managers, and less like MFA tokens No: - I can always export and import all my passwords from/into my password manager - My passwords always work independently of a password manager or any specific app/OS/hardware That is not true for passkeys and makes them much more like tokens. Of course they don't have to be used in MFA, just like passwords.

I just exported my Bitwarden vault and the resulting .json file has my passkeys in it. I'm not going to try to test import, but if it doesn't work that would obviously be more "bug" than anything else. Clearly "export" is the high concern functionality and once exported, importing them is not a big deal.

This is only about your first paragraph, it doesn't affect your second.

Re: Emailing a one-time code is worse than passwords

#399

Post by [deleted] »

DecoPerson wrote: post #19

The attack pattern is: 1) User goes to BAD website and signs up. 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.” 3) BAD’s bots start a “Sign in with email one-time code” flow on the GOOD website using the user’s email. 4) GOOD sends a one-time login code email to the user’s email address. 5) The user is very likely to trust…

[deleted]

Re: Emailing a one-time code is worse than passwords

#400

Post by jerf »

tecleandor wrote: post #200
yoz-y wrote: post #103

Earlier quoted context omitted.

I don’t like passkeys. Before my process to login was: - open website - if not already logged in, log in to 1Password - autofill password - autofill TOTP Now: - open website - if logged in to 1Password the Use Passkey usually shows up - if not: - log in to 1Password - choose use passkey - this almost always does nothing - choose “use other method” - choose “password” - autofill that - now there is another dialog to c…

And if I'm not using passkey, but the web site detects I'm using a passkey-compatible browser or password manager, the site takes over and tries to "sell" me a passkey anyway. No, I don't want it!

I forget which site it is but there is one site I try to use with passkeys that somehow bypasses my BitWarden and rigidly insists on a passkey tied to Google and/or my phone, which I do not want. (My BitWarden stack is fully owned by me, as I self-host a VaultWarden instance, with daily backups of it, and I don't want my passkeys anywhere else.) That's definitely annoying.
Post reply on HN