Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Emailing a one-time code is worse than passwords

blog.danielh.cc

Post reply on HN
Print view View original

501–510 of 816 posts

Re: Emailing a one-time code is worse than passwords

#501

Post by radlad »

roelschroeven wrote: post #194
DecoPerson wrote: post #19

The attack pattern is: 1) User goes to BAD website and signs up. 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.” 3) BAD’s bots start a “Sign in with email one-time code” flow on the GOOD website using the user’s email. 4) GOOD sends a one-time login code email to the user’s email address. 5) The user is very likely to trust…

> “Click a link in the email” is a tiny bit better because it takes the user straight to the GOOD website, and passing that link to BAD is more tedious and therefore more suspicious. "Click a link in the email" is really bad because it's very difficult to know the mail and the link in it are legitimate. Trusting links in emails opens to door to phishing attacks.

How would a phishing attack against a website which doesn't use passwords, only magic links, be performed?

Re: Emailing a one-time code is worse than passwords

#502

Post by arccy »

mvieira38 wrote: post #448
DecoPerson wrote: post #19

The attack pattern is: 1) User goes to BAD website and signs up. 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.” 3) BAD’s bots start a “Sign in with email one-time code” flow on the GOOD website using the user’s email. 4) GOOD sends a one-time login code email to the user’s email address. 5) The user is very likely to trust…

>"I’d rather granny needs to visit the bank to get access to her account again, than someone phishes her and steals all her money." More like abuelita gets robbed at gunpoint and made to unlock and clear out her bank account, then has no recourse at home because her device was taken. I live in a third world country and even 2FA simply isn't viable for me due to how frequent phone robberies are. I've had to do the pro…

A key part of the recent push for passkeys has been cross device syncing with your Google / Apple / whatever password manager account, so you end up in the same situation: if you can log in to Bitwarden to access your passwords, you can log in to your password manager to access your passkeys.

Re: Emailing a one-time code is worse than passwords

#503

Post by xg15 »

doublerabbit wrote: post #246
pyrale wrote: post #158

Earlier quoted context omitted.

We need to go further. If a service doesn't include 197 factors including blood samples, showing up at a physical location 50 miles from your home, and sending a picture of yourself in a specific posture, and doesn't require you to use at least 53 of them (determined randomly) to login, then it's insecure and should not be used.

Sounds like something the UK gov would love to implement, plus extra. Such as finding a dinosaur fossil of your families name clan.

I mean, the Scots technically still use a rock to authenticate their king.

https://en.wikipedia.org/wiki/Stone_of_Scone

Re: Emailing a one-time code is worse than passwords

#504

Post by arccy »

freeopinion wrote: post #497
DecoPerson wrote: post #19

The attack pattern is: 1) User goes to BAD website and signs up. 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.” 3) BAD’s bots start a “Sign in with email one-time code” flow on the GOOD website using the user’s email. 4) GOOD sends a one-time login code email to the user’s email address. 5) The user is very likely to trust…

Please help me understand the passkey flow that solves this problem. 1) BAD actor tries to create account at GOOD website posing as oblivious@example.com. 2) GOOD website requests public key from BAD. 3) BAD provides self-generated public key. 4) GOOD later asks BAD to prove that they control the private key. 5) BAD successfully proves they control the private key. Unless you have step 3b where GOOD can independently…

that's just a strawman bad account creation flow that has nothing to do with passkeys. you verify the email address first.

passkeys use a unique keypair per account, there's no single public key that represents you.

Re: Emailing a one-time code is worse than passwords

#505

Post by arccy »

PaulKeeble wrote: post #409
smallerfish wrote: post #241

Earlier quoted context omitted.

> Passkeys is the way to go. Password manager support for passkeys is getting really good. I set up a passkey for github at some point, and apparently saved it in Chrome. When I try to "use passkey for auth" with github, I get a popup from Chrome asking me to enter my google password manager's pin. I don't know what that pin is. I have no way of resetting that pin - there's nothing about the pin in my google profile,…

I really dislike how passkeys have generally been used. Once KeepassXC got proper support of them and in the browser plugin its been a bit more sensible. KeepassXC means I can transfer them between devices and its protected the same way my passwords are so no additional pins and logins I don't want, it solves a lot of the issues I have around them. Now its just a long random password. I wouldn't have minded if we mov…

passkeys are public / private keys. it's just a new pair for every log in.

Re: Emailing a one-time code is worse than passwords

#506

Post by paradox460 »

KingOfCoders wrote: post #375
roelschroeven wrote: post #232

Earlier quoted context omitted.

How do you know the email comes from that website? There are known cases of phishing mails being sent when people expect a legitimate mail.

The website is abc.com the link in the email is abc.com

The link in the email is a mailchimp wrapped tracking link with a gibberish URL. What now

Re: Emailing a one-time code is worse than passwords

#507

Post by lelandbatey »

tialaramex wrote: post #71
t_mann wrote: post #65

Earlier quoted context omitted.

The problems of Passkeys are more nuanced than just losing access when a device is lost (which actually doesn't need to happen depending on your setup). The biggest problem are attestations, which let services block users who use tools that give them more freedom. Passkeys, or more generally challenge-response protocols, could easily have been an amazing replacement for passwords and a win-win for everyone. Unfortuna…

Do you have some examples where people actually require attestation in 3rd party facing systems? Or is this purely "But in theory..." and you've dismissed all the very real problems with the alternatives because you're scared of a theoretical problem ? I always reject attestation requests and I don't recall ever having been refused, so if this was a real problem it seems like I ought to have noticed by now.

The Fido2 folks really really want things to be so secure and centralized, with so little user freedom, and they want to use attestation to do it.

Here's a Fido2 member (Okta) employee saying "If keepass allows users to back up passkeys to paper, I think we'll have to allow providers to block keepass via attestation." https://github.com/keepassxreboot/keepassxc/issues/10407#iss...

All because passkeys backup is deemed "too unsafe and users should never be allowed that feature, so if you implement it we'll kick you out of the treehouse."

The authoritarian nature of passkeys is already on full display. I hope they never get adopted and die.

Re: Emailing a one-time code is worse than passwords

#508

Post by [deleted] »

charcircuit wrote: post #272
j1elo wrote: post #251

Earlier quoted context omitted.

I have 531 logins for varied websites and services. Would you enjoy having to change 531 passkey devices? Me neither. But default login flows in all these sites prompt you to use your current device as passkey by default, so people who don't know better (i.e. a general "everybody") are being gently pushed to do so.

No, which is why there is the cross platform standard CXF which allows for cross platform sharing of passkeys. Apple has announced that support for this is shipping later this year with iOS 26. Google hasn't announced when they are shipping it yet.

[deleted]

Re: Emailing a one-time code is worse than passwords

#509

Post by lhamil64 »

bccdee wrote: post #466
mvieira38 wrote: post #448

Earlier quoted context omitted.

>"I’d rather granny needs to visit the bank to get access to her account again, than someone phishes her and steals all her money." More like abuelita gets robbed at gunpoint and made to unlock and clear out her bank account, then has no recourse at home because her device was taken. I live in a third world country and even 2FA simply isn't viable for me due to how frequent phone robberies are. I've had to do the pro…

FYI, you can put a 2FA secret into Bitwarden and autofill the one-time passwords alongside the regular password. That would mitigate the impact of losing your phone.

I personally don't do this because I feel like it defeats the whole purpose of 2fa. If someone gets into your bitwarden account, now they have your passwords and can generate 2fa codes. Of course, if the alternative is just not doing 2fa then it's better than nothing but I'd still prefer an authenticator app or hardware key than putting them in bitwarden.
Post reply on HN