Emailing a one-time code is worse than passwords

Post by grahameb » Thu, Aug 07, 2025, 3:06 PM UTC

serpix wrote: post #310

grahameb wrote: post #261

I recently set up passkey-only sign ins for a webapp I'm writing using Authentik [0](Python OIDC provider, with quite a nice docker-compose run-up, took only minutes to stand up.) It was surprisingly easy to configure everything so that passkeys are the only thing ever used. If anyone would be interested I could write it up? I was surprised what a nice user flow it is and how easy it was to achieve. [0] https://goaut…

so many of these Authentication providers have a hockey stick pricing scheme, where the first few users are near free and when you grow you are going to get mugged and kicked in the groin.

Post by mvieira38 » Thu, Aug 07, 2025, 3:07 PM UTC

lhamil64 wrote: post #509

bccdee wrote: post #466

Earlier quoted context omitted.

FYI, you can put a 2FA secret into Bitwarden and autofill the one-time passwords alongside the regular password. That would mitigate the impact of losing your phone.

I personally don't do this because I feel like it defeats the whole purpose of 2fa. If someone gets into your bitwarden account, now they have your passwords and can generate 2fa codes. Of course, if the alternative is just not doing 2fa then it's better than nothing but I'd still prefer an authenticator app or hardware key than putting them in bitwarden.

Post by ClikeX » Thu, Aug 07, 2025, 3:10 PM UTC

M95D wrote: post #205

donatj wrote: post #35

Earlier quoted context omitted.

You misread the short article. It's about email as single factor auth, which has become very trendy of late. You just enter your email address, no password, and the email you a code. Access to your email is the only authentication.

But then, email always was the only authentication. On any site, click "forgot password" and promptly they send you a reset password link. Very few sites have a challenge question.

Post by jghn » Thu, Aug 07, 2025, 3:12 PM UTC

bombcar wrote: post #365

jghn wrote: post #363

Earlier quoted context omitted.

If the target was not actively trying to log into GOOD at that exact moment, why would they treat this as anything other than one of a phishing attempt or spam?

Because target WAS trying to login to BAD. Imagine a "free porn, login here" website, when you put in your gmail address it triggers the onetime code from gmail (assuming it did that type of login) - thousands would give it up for the free porn.

Post by wkat4242 » Thu, Aug 07, 2025, 3:14 PM UTC

rcxdude wrote: post #146

tux3 wrote: post #81

Earlier quoted context omitted.

Microsoft Entra ID goes out of its way to enforce attestation for FIDO 2 keys. The protocol normally allows you to omit the attestation, but they worked around an extra call after a successful registration flow that sends you to an error page if your FIDO2 passkey isn't from one of these large approved vendors: https://learn.microsoft.com/en-us/entra/identity/authenticat... I found out by trying to prototype my own F…

Ah, and even if you can turn it off as the administrator, you still need to include the attestation, it's just not checked. Gotta love Microsoft...