Emailing a one-time code is worse than passwords • Hacker News Board

Re: Emailing a one-time code is worse than passwords

#451

Post by otterley » Thu, Aug 07, 2025, 2:12 PM UTC

emushack wrote: post #378

acdha wrote: post #333

Earlier quoted context omitted.

That’s a lot of anger without a substantial argument. For Apple users, for example, the user experience is very smooth and the mental model is “I use iCloud to store my passcode just like I use iCloud to store my passwords”. If you use 1Password, you’re changing iCloud for 1Password instead.

"You lost me the moment you mentioned iCloud". At least that's the way the majority of people I know react to this line of thinking. The "cloud" is still mysterious and complicated to a good number of people. Passwords are easy to understand.

Most people use the cloud without even knowing it. If you instead say it’s seamlessly replicated among all your devices, that is a good enough explanation and conveys the benefits to customers.

Re: Emailing a one-time code is worse than passwords

#452

Post by anonymars » Thu, Aug 07, 2025, 2:13 PM UTC

pandorobo wrote: post #37

max__dev wrote: post #30

Earlier quoted context omitted.

The article is not about MFA. It is about using email as a single factor.

Thats simple a lie or you didn't read the article. The very first bullet point states: Enter an email address or phone number That insinuates email OR SMS. It doesn't just mention email only.

What is the minimum number of things you need access to in order to log in?

If you have access to the phone, you can log in. OR if you have access to the email account, you can log in.

You don't need to know the user's password, you only need access to one of these inboxes and nothing else. One-factor authentication, but worse, because there are multiple attack surfaces.

Re: Emailing a one-time code is worse than passwords

#453

Post by Hackbraten » Thu, Aug 07, 2025, 2:13 PM UTC

smallerfish wrote: post #236

DecoPerson wrote: post #19

The attack pattern is: 1) User goes to BAD website and signs up. 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.” 3) BAD’s bots start a “Sign in with email one-time code” flow on the GOOD website using the user’s email. 4) GOOD sends a one-time login code email to the user’s email address. 5) The user is very likely to trust…

But you could replace #2 with "Enter your password from GOOD, as they are our sign-in partner". I'm not in favor of emailing 6 digit codes either, but your scenario presupposes that users will be willing to trust that two services have intermingled their auth, and in that case their password can be wrangled from them too.

My password manager won’t allow autofilling in the latter case, because it remembers the domain I used at sign-up time.

On the rare occasion that my password manager refuses to autofill, I take a step back and painstakingly try to understand why. This happens about once a year or twice.

Re: Emailing a one-time code is worse than passwords

#454

Post by chimeracoder » Thu, Aug 07, 2025, 2:14 PM UTC

mvieira38 wrote: post #448

DecoPerson wrote: post #19

The attack pattern is: 1) User goes to BAD website and signs up. 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.” 3) BAD’s bots start a “Sign in with email one-time code” flow on the GOOD website using the user’s email. 4) GOOD sends a one-time login code email to the user’s email address. 5) The user is very likely to trust…

>"I’d rather granny needs to visit the bank to get access to her account again, than someone phishes her and steals all her money." More like abuelita gets robbed at gunpoint and made to unlock and clear out her bank account, then has no recourse at home because her device was taken. I live in a third world country and even 2FA simply isn't viable for me due to how frequent phone robberies are. I've had to do the pro…

> More like abuelita gets robbed at gunpoint and made to unlock and clear out her bank account, then has no recourse at home because her device was taken.

You are describing the current status quo, without passkeys. This is already possible.

Well, except maybe for the "without recourse" part, because there are some legal and policy avenues available for dealing with this situation.

Re: Emailing a one-time code is worse than passwords

#455

Post by RcouF1uZ4gsC » Thu, Aug 07, 2025, 2:15 PM UTC

DecoPerson wrote: post #19

The attack pattern is: 1) User goes to BAD website and signs up. 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.” 3) BAD’s bots start a “Sign in with email one-time code” flow on the GOOD website using the user’s email. 4) GOOD sends a one-time login code email to the user’s email address. 5) The user is very likely to trust…

> 1) User goes to BAD website and signs up.

I think this is what Raymond Chen calls the other side of the airtight hatch.

The game is already over. The user is already convinced the BAD website is the good website. The BAD website could just ask the user for the email and password already and the user would directly provide it. The email authenticaton flow doesn’t introduce any new vulnerability and in fact, may reduce it if the user actually signs in via a link in the email.

Re: Emailing a one-time code is worse than passwords

#456

Post by charcircuit » Thu, Aug 07, 2025, 2:15 PM UTC

kbolino wrote: post #420

charcircuit wrote: post #255

Earlier quoted context omitted.

Reducing passkeys to the security level of passwords is not just "making something user friendly". It's undoing all of the hardware everyone else in the ecosystem is putting into to making a more secure way for authentication to be done.

Passkeys have several advantages over passwords but not all of them rely on UX controls. They are, after all, public-private keypairs and the private part is never shared during authentication. The wider web never adopted PAKEs so passwords are still sent verbatim over the (TLS-protected) wire.

With password managers passwords are not reused which avoids this problem already.

Re: Emailing a one-time code is worse than passwords

#457

Post by anonymars » Thu, Aug 07, 2025, 2:16 PM UTC

djoldman wrote: post #339

Relatedly with respect to passkeys, it seems we have the following tradeoff (simplified): 1. authentication via password: accounts stolen by criminals and then inaccessible to the user. 2. authentication via passkey: accounts lost by users because passkeys have friction, to say the least, when devices are lost/stolen/transferred. It seems that big providers would much rather scenario 2.

There's a saying, isn't there? Cryptography fundamentally reduces to a key management problem

Re: Emailing a one-time code is worse than passwords

#458

Post by rpdillon » Thu, Aug 07, 2025, 2:17 PM UTC

Hackbraten wrote: post #436

blkhawk wrote: post #389

Earlier quoted context omitted.

uh no - a password manager is an open source application you can compile and install yourself if you want. Its nothing more than a small specialised database with a excel like interface. Personally I think that the argument that things are "too complicated for the average user" eventually gets gets you users that find breathing and sphincter function too complicated.

I’ve been observing this space for two decades and haven’t come across a single open-source password manager that actually works, is properly maintained, has an acceptable security track record, and comes with a similarly well-maintained browser extension that protects both my clipboard and myself from phishing.

I've been using Keepass for two decades and have never had a single issue. I would never recommend a browser plug in (too much attack surface area), and instead simply check the URL before having KeePass autotype. No clipboard.

I think you're rejecting good solutions out of hand.

Meanwhile...millions of users trusted LastPass. Twice.

Re: Emailing a one-time code is worse than passwords

#459

Post by charcircuit » Thu, Aug 07, 2025, 2:17 PM UTC

sam_lowry_ wrote: post #388

charcircuit wrote: post #371

Earlier quoted context omitted.

You don't, but with one services have a better guarantee that they are.

Services, by definition, serve. Why should we, the users, care about their guarantees?

Because users want the services they use to be good. They don't want to be sent phishing links from their friend's account that was hijacked by attackers.

Re: Emailing a one-time code is worse than passwords

#460

Post by anonymars » Thu, Aug 07, 2025, 2:17 PM UTC

esjeon wrote: post #306

The actual weak link here is not the procedure itself. It’s the fact that your email services will happily accept phishing mails into your inbox. I’m pretty sure we can prevent this by issuing some kind of proof of agreement (with sender and recipient info) thru email services. Joining a service becomes submitting a proof to the service, and any attempt to contact the user from the service side must be sealed with th…

The email is coming from the legitimate service, it's a man-in-the-middle attack.

How does this scheme stop you from putting a legitimate code from a legitimate sender into an illegitimate website?