Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Emailing a one-time code is worse than passwords

blog.danielh.cc

Post reply on HN
Print view View original

431–440 of 816 posts

Re: Emailing a one-time code is worse than passwords

#431

Post by bongodongobob »

jiggawatts wrote: post #156
iEchoic wrote: post #112

Four times a day, I get an email notification that someone requested a password reset for my Microsoft account, which gives me a six-digit number to recover my account. So every day, an attacker has four shots in 1,000,000 of stealing my account by just guessing the number. They've been doing this for years. If the attacker's doing this to thousands of accounts - which I'm sure they are - they're going to be stealing…

I was authenticating a set of scripts five times for each run with MFA. Once, it asked me for six MFA prompts with no disambiguating info. Did I click “Yes” to the attack the fifth time, or was the sixth the attack? Or was it just a “hiccup” in the system? Do I cancel the migration job and start from the beginning or roll the dice? It’s beyond idiotic asking a Yes/No question with zero context, but that was the defau…

Should be using app registrations for that, not user accounts.

Re: Emailing a one-time code is worse than passwords

#432

Post by kbolino »

probably_wrong wrote: post #222
klipt wrote: post #118

Earlier quoted context omitted.

> I’d rather granny needs to visit the bank to get access to her account again Visiting the bank is fine. But who do you visit to recover your Gmail password?

For the record, if you're in the EU you can make a GDPR request to their Data Protection Officer - since it's your data what's being kept away from you, you have the right to at least a backup. It can take months and it only guarantees a backup, not full access, but it's better than nothing.

Even if they provide you with a dump of their database records on you, you will not be able to recover your password from the salted iterated hash, PBKDF2, bcrypt, Argon2, or whatever else irreversible function they used to store it.

Re: Emailing a one-time code is worse than passwords

#433

Post by kbolino »

charcircuit wrote: post #233
patrakov wrote: post #116

Earlier quoted context omitted.

The scary part is not about losing her phone. It's about having to keep the old, no-longer-secure Android phone alive just for passkeys after getting a shiny (and secure) new iPhone.

You can add the new phone as an additional passkey. I don't see how this would be scary.

AFAIK, there is no requirement for websites to support multiple passkeys nor, if they do, to support them in a sensible way. Some sites do this well, most don't.

Re: Emailing a one-time code is worse than passwords

#434

Post by tonyhart7 »

clickety_clack wrote: post #403
frameset wrote: post #240

Earlier quoted context omitted.

To defend Redmond here, Entra is an enterprise system. If the company you work for or are interfacing with wants to enforce attestation, that's their business. B2C I would expect more latitude on requiring attestation.

Exactly. For personal authentication, you are at least personally incentivized to do the right things. For corporate auth, people will do whatever it takes to skip any kind of login. I once knew a guy who refused to let his office computer go to sleep just to avoid having to enter his password to unlock his computer. He was a really senior guy too, so IT bent to allow him do this. What finally made him lock his compu…

lol this is funny, why he didn't want to sign in more often tho???

Re: Emailing a one-time code is worse than passwords

#435

Post by TechDebtDevin »

DecoPerson wrote: post #19

The attack pattern is: 1) User goes to BAD website and signs up. 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.” 3) BAD’s bots start a “Sign in with email one-time code” flow on the GOOD website using the user’s email. 4) GOOD sends a one-time login code email to the user’s email address. 5) The user is very likely to trust…

I haven't been able to get into my Oracle (free) account for 2 years because I lost 2fa... Unless I start needing to pay them for something, they'll probably never answer my emails. There are consequences for losing your phone when using alternative authentication methods (be careful).

Re: Emailing a one-time code is worse than passwords

#436

Post by Hackbraten »

blkhawk wrote: post #389
codedokode wrote: post #373

Earlier quoted context omitted.

Password managers are those proprietary programs that you need to install, give full access to your computer, register an account and trust their word that your passwords are uploaded to the cloud securely? No thanks. Also they are too complicated for an ordinary user. A physical key is much simpler and doesn't require any setup or thinking, and can be used on multiple devices without any configuration. And doesn't r…

uh no - a password manager is an open source application you can compile and install yourself if you want. Its nothing more than a small specialised database with a excel like interface. Personally I think that the argument that things are "too complicated for the average user" eventually gets gets you users that find breathing and sphincter function too complicated.

I’ve been observing this space for two decades and haven’t come across a single open-source password manager that actually works, is properly maintained, has an acceptable security track record, and comes with a similarly well-maintained browser extension that protects both my clipboard and myself from phishing.

Re: Emailing a one-time code is worse than passwords

#437

Post by jp191919 »

PaulKeeble wrote: post #409
smallerfish wrote: post #241

Earlier quoted context omitted.

> Passkeys is the way to go. Password manager support for passkeys is getting really good. I set up a passkey for github at some point, and apparently saved it in Chrome. When I try to "use passkey for auth" with github, I get a popup from Chrome asking me to enter my google password manager's pin. I don't know what that pin is. I have no way of resetting that pin - there's nothing about the pin in my google profile,…

I really dislike how passkeys have generally been used. Once KeepassXC got proper support of them and in the browser plugin its been a bit more sensible. KeepassXC means I can transfer them between devices and its protected the same way my passwords are so no additional pins and logins I don't want, it solves a lot of the issues I have around them. Now its just a long random password. I wouldn't have minded if we mov…

KeepassXC's passkey integration has been excellent for me. No vendor lock-in is important to me.

Re: Emailing a one-time code is worse than passwords

#438

Post by hombre_fatal »

zozbot234 wrote: post #195
DecoPerson wrote: post #19

The attack pattern is: 1) User goes to BAD website and signs up. 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.” 3) BAD’s bots start a “Sign in with email one-time code” flow on the GOOD website using the user’s email. 4) GOOD sends a one-time login code email to the user’s email address. 5) The user is very likely to trust…

> I'd rather granny needs to visit the bank to get access to her account again, than someone phishes her and steals all her money. The problem is that I can physically show up at my local bank branch or at my job's IT helpdesk to get my account back, but I can't show up at the Googleplex or at Facebook's or Xitter's HQ and do the same. Device bound passkeys are very error prone for the latter scenario, since users wi…

To add, services account for that failure by introducing something worse: a customer service backdoor where you can get into an account with very weak or nonexistent authentication.

With Amazon's live chat, someone was able to get into my account by providing an address in the same city as the destination of my latest Amazon order.

You see this with 2FA since "sorry lol you've lost your account forever" isn't an option, and it's trivial for users to lose their 2FA key unlike, say, access to their email.

Re: Emailing a one-time code is worse than passwords

#439

Post by eddythompson80 »

reginald78 wrote: post #369
eddythompson80 wrote: post #33

Earlier quoted context omitted.

What do you mean by real backups? What's stopping you from backing up your keys? Its up to the passkey "provider" to allow passkeys backup/sync.

Well, having your passkey provider blocked for doing that might stop you. https://github.com/keepassxreboot/keepassxc/issues/10407 Of course, they might just block you for not being on a whitelist of approved providers anyway.

That's such a strawman argument. Read the link you pasted again

Re: Emailing a one-time code is worse than passwords

#440

Post by bux93 »

Arrowmaster wrote: post #28
anonymars wrote: post #9

Earlier quoted context omitted.

I'm not familiar with this issue and a quick search didn't turn up anything obvious. Would you mind elaborating?

They are referring to the ability of a site you are logging into forcing you to use a client from a specific list or having a list of clients to deny. It's copied over from FIDO hardware keys where each device type needed to be identifiable so higher tier ones could be required or unsecured development versions could be blocked.

It's like DRM: it will annoy legitimate users and keep them from obviously legit usecases, and be circumvented by people who are motivated.
Post reply on HN