[dead]
Emailing a one-time code is worse than passwords
491–500 of 816 posts
Re: Emailing a one-time code is worse than passwords
#492[dead]
Re: Emailing a one-time code is worse than passwords
#493Earlier quoted context omitted.
> The without recourse is the part that matters... Yes, and I'm saying that part isn't accurate either for the story you're portraying with passkeys or for the status quo. That's not how account recovery flows work.
With passwords, no account was even lost in the scenario for a recovery flow to start. An account recovery flow is only necessary because of the superfluous extra security, which will almost inevitably introduce more attack vectors than before (such as a social engineering attack through customer service) if the banks want to service customers like grandmas.
> With passwords, no account was even lost in the scenario for a recovery flow to start
Given how common mandatory SMS 2FA is for banks, if thieves stole your unlocked phone, they have stolen your account too.
Re: Emailing a one-time code is worse than passwords
#494Earlier quoted context omitted.
How do you know the email comes from that website? There are known cases of phishing mails being sent when people expect a legitimate mail.
The website is abc.com the link in the email is abc.com
unless the product manager decided the link in the email is
track.monkey.exe/sus/path/spyware?c=behhdywbsncocjdb&b=ndbejsudndbd&k=uehwbehsysjendbdhjdodj
or something 2x–3x longer
Re: Emailing a one-time code is worse than passwords
#495And even if proper passwords are used, many sites/apps use this pattern for account recovery if the password is forgotten so effectively this is the only security as an attacker has “forgotten” the password and just uses this flow to login. I've got a little generic login tool that bits I write myself use for login, using this method, but it is not for anything sensitive or otherwise important (I just want to identif…
> And even if proper passwords are used, many sites/apps use this pattern for account recovery if the password is forgotten so effectively this is the only security as an attacker has “forgotten” the password and just uses this flow to login.
Was about to post just this. This is the flow they use for account recovery so it's the weakest link in the chain anyway.
Re: Emailing a one-time code is worse than passwords
#496Earlier quoted context omitted.
FYI, you can put a 2FA secret into Bitwarden and autofill the one-time passwords alongside the regular password. That would mitigate the impact of losing your phone.
Great, this is a universal solution. Let's all make it an integral part of our digital security, and in 5 years or so hope that bitwarden doesn't leverage it!
the good news is that you can self-host bitwarden pretty easily and so it doesn't have to be a hassle/risk
Re: Emailing a one-time code is worse than passwords
#497The attack pattern is: 1) User goes to BAD website and signs up. 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.” 3) BAD’s bots start a “Sign in with email one-time code” flow on the GOOD website using the user’s email. 4) GOOD sends a one-time login code email to the user’s email address. 5) The user is very likely to trust…
Please help me understand the passkey flow that solves this problem.
1) BAD actor tries to create account at GOOD website posing as oblivious@example.com.
2) GOOD website requests public key from BAD.
3) BAD provides self-generated public key.
4) GOOD later asks BAD to prove that they control the private key.
5) BAD successfully proves they control the private key.
Unless you have step 3b where GOOD can independently confirm that the public key does indeed belong to oblivious. But even that is easily worked around.
Re: Emailing a one-time code is worse than passwords
#498Earlier quoted context omitted.
It's not broken. It's just potentially less helpful when it comes to protecting poor guessable passwords. bcrypt isn't the problem, weak password policies/habits are. Like bcrypt, argon2 is just a bandaid, though a tiny bit thicker. It won't save you from absurdly short passwords or silly "correct horse battery staple" advice, and it's no better than bcrypt at protecting proper unguessable passwords. Also, only devel…
Bcrypt alone is unfit for purpose. Argon2 does not need its input to be predigested. It's easy for somebody who knows this to fix bcrypt, but silently truncating the input was an unforced error. The fact that it looks like and was often sold as the right tool for the job but isn't has led to real-world vulnerabilities. It's a classic example of crypto people not anticipating how things actually get used. (Otherwise,…
Peppering is for protecting self-contained password hashes in case they leak. It's a secondary salt meant to be situated 1) external to the hash, and 2) external to the storage component the hashes reside in (i.e. not in the database you store accounts and hashes in). The method has nothing to do with trying to fix anything with bcrypt. You should be peppering your input even if you use Argon2.
Re: Emailing a one-time code is worse than passwords
#499> This is terrible for account security
It's "terrible" because the author can describe exactly one phishing vector?..
Have you ever tried resetting a password before? Passwords have a similar phishing vector, plus many other problems that magic links and one-time login codes don't have.
If six-digit login codes are less secure than passwords, the reasons why are certainly not found in this article.
Re: Emailing a one-time code is worse than passwords
#500To be fair, it can be even funnier:
The "Simply" music apps use a four digit code, sent by mail. And that never changes.
Easy account sharing! It is a feature!