Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Emailing a one-time code is worse than passwords

blog.danielh.cc

Post reply on HN
Print view View original

521–530 of 816 posts

Re: Emailing a one-time code is worse than passwords

#521

Post by freeopinion »

arccy wrote: post #504
freeopinion wrote: post #497

Earlier quoted context omitted.

Please help me understand the passkey flow that solves this problem. 1) BAD actor tries to create account at GOOD website posing as oblivious@example.com. 2) GOOD website requests public key from BAD. 3) BAD provides self-generated public key. 4) GOOD later asks BAD to prove that they control the private key. 5) BAD successfully proves they control the private key. Unless you have step 3b where GOOD can independently…

that's just a strawman bad account creation flow that has nothing to do with passkeys. you verify the email address first. passkeys use a unique keypair per account, there's no single public key that represents you.

Indeed, I was illustrating that DecoPerson was proposing that passkeys solve an account creation flow problem. They do not.

But as DecoPerson points out, in the realm of account creation, your "verify the email address first" solution has its limits.

It is easy to conflate different aspects of trust and think they have the same solution.

Re: Emailing a one-time code is worse than passwords

#522

Post by SpaceNoodled »

DecoPerson wrote: post #19

The attack pattern is: 1) User goes to BAD website and signs up. 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.” 3) BAD’s bots start a “Sign in with email one-time code” flow on the GOOD website using the user’s email. 4) GOOD sends a one-time login code email to the user’s email address. 5) The user is very likely to trust…

Passkeys are just passwords that require a password manager.

Re: Emailing a one-time code is worse than passwords

#523

Post by gethly »

ascorbic wrote: post #79
gethly wrote: post #61

Earlier quoted context omitted.

It means that you go to foo.com and enter your e-mail to sign up. But foo.com routes that request and to bank.com, hoping you have an account there. bank.com sends you verification email, which you expect from foo.com as part of the sign-up verification process. For some bat shit crazy reason, you ignore that the email came from bank.com and not foo.com and you type in the secret code from the email into the foo.com…

The evil site usually says something like "enter the code from our identity partner x" or something, which is a lot more believable when it's a service like Microsoft that does provide services like that.

That is not how oAuth works.

Re: Emailing a one-time code is worse than passwords

#524

Post by sam_lowry_ »

charcircuit wrote: post #459
sam_lowry_ wrote: post #388

Earlier quoted context omitted.

Services, by definition, serve. Why should we, the users, care about their guarantees?

Because users want the services they use to be good. They don't want to be sent phishing links from their friend's account that was hijacked by attackers.

I had a meeting with a public servant this morning. He is part of an organization that promotes multi-factor authentication and publicly endorses the view that users are stupid.

The meeting was about him unable to test the APK of the new version of their mobile app. He felt embarrassed, his mobile phone is enrolled in the MDM scheme that disallows side-loading of apps.

What I am trying to say is that assuming users are stupid carries a non-negligible risk that you will be that stupid user one day.

Re: Emailing a one-time code is worse than passwords

#526

Post by nightski »

dare944 wrote: post #512
ssk42 wrote: post #496

Earlier quoted context omitted.

the good news is that you can self-host bitwarden pretty easily and so it doesn't have to be a hassle/risk

Grandma is self-hosting what???

I am going to be honest, Grandma is already compromised.

Re: Emailing a one-time code is worse than passwords

#527

Post by clickety_clack »

tonyhart7 wrote: post #434
clickety_clack wrote: post #403

Earlier quoted context omitted.

Exactly. For personal authentication, you are at least personally incentivized to do the right things. For corporate auth, people will do whatever it takes to skip any kind of login. I once knew a guy who refused to let his office computer go to sleep just to avoid having to enter his password to unlock his computer. He was a really senior guy too, so IT bent to allow him do this. What finally made him lock his compu…

lol this is funny, why he didn't want to sign in more often tho???

He was completely non technical and I guess he figured that IT should be able to work the security system around him.

Re: Emailing a one-time code is worse than passwords

#528

Post by const_cast »

eddythompson80 wrote: post #59
Ferret7446 wrote: post #54

Earlier quoted context omitted.

> It's about email as single factor auth, which has become very trendy of late I must be in the wrong bubble, I have not encountered any site that does this since the 2000s. It was a minor trend around then IIRC.

Anthropic is the main one. Its pushing a lot of others to do the same. I literally was arguing against that 2 weeks ago and the person who was pushing it said "Claude does that. Its really slick, no password to remember". Patreon can do that too, depending on how you sign up.

A lot of services just do this de-facto, where you only need an email code to reset the password. Which is equivalent to single auth with email.

Email link to reset is better, email link + another auth (usually sms) is even better.

Re: Emailing a one-time code is worse than passwords

#529

Post by michaelmrose »

DecoPerson wrote: post #19

The attack pattern is: 1) User goes to BAD website and signs up. 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.” 3) BAD’s bots start a “Sign in with email one-time code” flow on the GOOD website using the user’s email. 4) GOOD sends a one-time login code email to the user’s email address. 5) The user is very likely to trust…

What about the 99 other places granny needs to regain access to after the much more common broke or lost phone many of which doesn't have a meaningful amount of customer service.

I see no reason not to use password + one of multiple 2FA methods so the user can regain control.

Re: Emailing a one-time code is worse than passwords

#530

Post by ulysss »

stavros wrote: post #106
pandorobo wrote: post #37

Earlier quoted context omitted.

Thats simple a lie or you didn't read the article. The very first bullet point states: Enter an email address or phone number That insinuates email OR SMS. It doesn't just mention email only.

It's still a single factor.

Agree with you
Post reply on HN