Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Emailing a one-time code is worse than passwords

blog.danielh.cc

Post reply on HN
Print view View original

401–410 of 816 posts

Re: Emailing a one-time code is worse than passwords

#401

Post by csomar »

> An attacker can simply send your email address to a legitimate service, and prompt for a 6-digit code. You can't know for sure if the code is supposed to be entered in the right place. Password managers (a usual defense against phishing) can't help you either.

Roughly the same security for password-login with email recovery. The only difference is that this makes the attack surface larger because the user is frequently using email.

The only secure login is through 1. a hardware device and 2. a solution where both the user/service are "married" and can challenge each other during the login process. This way, your certificate of authentication will also check that the site you are connecting to is who it says it is.

Re: Emailing a one-time code is worse than passwords

#402

Post by theschmed »

Lukas_Skywalker wrote: post #132
iEchoic wrote: post #112

Four times a day, I get an email notification that someone requested a password reset for my Microsoft account, which gives me a six-digit number to recover my account. So every day, an attacker has four shots in 1,000,000 of stealing my account by just guessing the number. They've been doing this for years. If the attacker's doing this to thousands of accounts - which I'm sure they are - they're going to be stealing…

I have added what I think they call login alias to my account. This blocks logins using the normal account username (which is my public email address), and only allows them via the alias (which is not public and just a random string). Not a single foreign login attempt since I enabled the alias. You can enable it on account.microsoft.com > Account Info > Sign-in preferences > Add email > Add Alias and make it primary…

I hadn't thought of this use case for aliases.

I had to make my Outlook email primary again on my Microsoft account, unfortunately, because of how I use OneDrive. I send people share invitations and there are scenarios (or at least there were the last time I checked) where sending invitations from the primary account email is the only way to deliver the invite. If your external email alias is primary, they'll attempt to send an email from Outlook's servers that spoofs the alias email :/

Re: Emailing a one-time code is worse than passwords

#403

Post by clickety_clack »

frameset wrote: post #240
tux3 wrote: post #81

Earlier quoted context omitted.

Microsoft Entra ID goes out of its way to enforce attestation for FIDO 2 keys. The protocol normally allows you to omit the attestation, but they worked around an extra call after a successful registration flow that sends you to an error page if your FIDO2 passkey isn't from one of these large approved vendors: https://learn.microsoft.com/en-us/entra/identity/authenticat... I found out by trying to prototype my own F…

To defend Redmond here, Entra is an enterprise system. If the company you work for or are interfacing with wants to enforce attestation, that's their business. B2C I would expect more latitude on requiring attestation.

Exactly. For personal authentication, you are at least personally incentivized to do the right things. For corporate auth, people will do whatever it takes to skip any kind of login.

I once knew a guy who refused to let his office computer go to sleep just to avoid having to enter his password to unlock his computer. He was a really senior guy too, so IT bent to allow him do this. What finally made him lock his computer was a colleague sending an email to all staff from his open outlook saying “Hi everyone, it’s my birthday today and I’m disappointed because hardly anyone has come by to wish me happy birthday”. The sheer mortification made him change his ways.

Re: Emailing a one-time code is worse than passwords

#404

Post by ilamont »

netcan wrote: post #273
DecoPerson wrote: post #19

The attack pattern is: 1) User goes to BAD website and signs up. 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.” 3) BAD’s bots start a “Sign in with email one-time code” flow on the GOOD website using the user’s email. 4) GOOD sends a one-time login code email to the user’s email address. 5) The user is very likely to trust…

Good points but dont underestimate "granny needs to visit the bank to get access to her account again " as a problem. For a lot of people, dealing with (now mostly digital) bureaucracies is a major stress in life. The biggest one, for some. Its not just about invonvenience. Its sometimes about losing access to some, and just not having it for a while. In terms of practical effect, a performance metric for a login sys…

That’s right.

How many HN denizens are the de facto tech support for family members when they can’t login, can’t update, can’t get rid of some unwanted behavior, or just can’t figure stuff out?

I don’t blame them one bit. The tech world has presented them with hundreds of different interfaces, recovery, processes, and policies dreamed up by engineers and executives who assume most of their user base is just like them.

Re: Emailing a one-time code is worse than passwords

#405

Post by angrydev »

Nevor wrote: post #249

There are some short comings about using email codes but I fail to see how this worse than passwords when the same exact kind of attack would work for passwords. The difference being that it would be worse with passwords which can be stored, reused later or sometimes changed directly on the service.

OP is just ragebait for nerds. How many articles have been published in the last 20 years about the issues with passwords? Now we're saying that the small chance some user ends up on bad-minecraft.com with a login form is actually worse than using "L3tmein!" as a password everywhere? Please find something more worthy to spend your time thinking about.

Re: Emailing a one-time code is worse than passwords

#406

Post by janfromdaito »

FuriouslyAdrift wrote: post #394
t_mann wrote: post #65

Earlier quoted context omitted.

The problems of Passkeys are more nuanced than just losing access when a device is lost (which actually doesn't need to happen depending on your setup). The biggest problem are attestations, which let services block users who use tools that give them more freedom. Passkeys, or more generally challenge-response protocols, could easily have been an amazing replacement for passwords and a win-win for everyone. Unfortuna…

We've had massive problems with moving to passkeys (browser based) at our company and moved back to an app based Authenticator. Everyone is accepting of the autenticator app or uses a yubikey.

What were those "massive problems"?

Re: Emailing a one-time code is worse than passwords

#407

Post by pkilgore »

Someone wrote: post #278
florieger wrote: post #271

Earlier quoted context omitted.

How is it worse than using a password? I think I'm missing something, please explain. 1) User goes to BAD website. 2) BAD website says “Please enter your email and password”. 3) BAD’s bots start a “Log in with email and password” on the GOOD website using the user’s email and password. 4) BAD now has full access to the user’s GOOD account.

People hopefully won’t reuse the username/password they use on GOOD to log into BAD, so the login that BAD does in step 3 will fail.

There is no password. That's the point.

It's just an email, and a six digit code they text you.

Re: Emailing a one-time code is worse than passwords

#408

Post by jrockway »

technion wrote: post #250
frameset wrote: post #240

Earlier quoted context omitted.

To defend Redmond here, Entra is an enterprise system. If the company you work for or are interfacing with wants to enforce attestation, that's their business. B2C I would expect more latitude on requiring attestation.

I would counter argue being the person pushing passkeys in an enterprise: noone in the business knows what attestation is, but we're going to do it because the interface recommends it.

I'm not sure it's the standards committee's fault that your employer hires people that don't know how to do their job.

I think it's reasonable to have attestation for the corporate use case. If they're buying security devices from a certain vendor, it's reasonable for their server to check that the person pretending to be you at the other end is using one of those devices. It's an extra bit of confidence that you're actually you.

Re: Emailing a one-time code is worse than passwords

#409

Post by PaulKeeble »

smallerfish wrote: post #241
DecoPerson wrote: post #19

The attack pattern is: 1) User goes to BAD website and signs up. 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.” 3) BAD’s bots start a “Sign in with email one-time code” flow on the GOOD website using the user’s email. 4) GOOD sends a one-time login code email to the user’s email address. 5) The user is very likely to trust…

> Passkeys is the way to go. Password manager support for passkeys is getting really good. I set up a passkey for github at some point, and apparently saved it in Chrome. When I try to "use passkey for auth" with github, I get a popup from Chrome asking me to enter my google password manager's pin. I don't know what that pin is. I have no way of resetting that pin - there's nothing about the pin in my google profile,…

I really dislike how passkeys have generally been used. Once KeepassXC got proper support of them and in the browser plugin its been a bit more sensible. KeepassXC means I can transfer them between devices and its protected the same way my passwords are so no additional pins and logins I don't want, it solves a lot of the issues I have around them. Now its just a long random password.

I wouldn't have minded if we moved to a scheme like SSH logins with public and private keys I own either, that I can store securely but load as I please and again would work well with a local password manager.

Re: Emailing a one-time code is worse than passwords

#410

Post by hshdhdhj4444 »

DecoPerson wrote: post #19

The attack pattern is: 1) User goes to BAD website and signs up. 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.” 3) BAD’s bots start a “Sign in with email one-time code” flow on the GOOD website using the user’s email. 4) GOOD sends a one-time login code email to the user’s email address. 5) The user is very likely to trust…

This comment explains why passkeys are nothing more than a way to shift responsibility.

If you lose all your data and your entire life because you lost your phone, no company is responsible.

But if you get hacked they are.

So they’ve come up with a solution that can destroy your entire life, but reduces the risk of corporate liability.

But yeah, keep carrying water for the entities that won’t come up with actual user focused solutions because it may cost them 0.01% of their profits.

Post reply on HN