Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Emailing a one-time code is worse than passwords

blog.danielh.cc

Post reply on HN
Print view View original

581–590 of 816 posts

Re: Emailing a one-time code is worse than passwords

#581

Post by anonymars »

vdfs wrote: post #534
NoGravitas wrote: post #490

Earlier quoted context omitted.

If they are doing this to 125,000 accounts, they should get an average of one account per day, right? So on average it would on average take them 342 years to get any specific account, but as long as they aren't trying for any particular account, they've got a pretty good ROI. I guess the fix for this would be exponential backoff on failed attempts instead of a static quota of 4 a day?

Why would doing this to 125K accounts give them access to one account per day? The chances of guessing 6-digtis pin code for each account is the same (10^6) regdless of how many accounts your are attacking

Guess the same code for every account.

Imagine the extreme case, where they pinged one million accounts and then tried the same code (123456) for each one. Statistically, 1 of those 1,000,000 six-digit TOTP codes will probably be 123456

Re: Emailing a one-time code is worse than passwords

#582

Post by [deleted] »

dare944 wrote: post #558
lijok wrote: post #415

Earlier quoted context omitted.

Your style of thinking is exactly why linux never became a leader in desktop os's. Why we're still dealing with the most ridiculous tech debt and complexity in OSS tooling to date. You're obsessed with fake problems that have no bearing on real people. When grandma does indeed loose all her money because some prick phished her password away, I would love to watch you explain how that's actually better than BigTech ta…

This argument is ridiculous and purposefully inflammatory. The issue at hand is the requirement for client attestation while using passkeys. So in that light, can you describe for us the scenario in which grandma, who is undoubtedly using passkeys on an iPhone or an Android, looses all her money simply because someone, somewhere else is using a passkey without attestation? You can't, because the vendor lock-in create…

[deleted]

Re: Emailing a one-time code is worse than passwords

#583

Post by otterley »

t_mann wrote: post #65
DecoPerson wrote: post #19

The attack pattern is: 1) User goes to BAD website and signs up. 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.” 3) BAD’s bots start a “Sign in with email one-time code” flow on the GOOD website using the user’s email. 4) GOOD sends a one-time login code email to the user’s email address. 5) The user is very likely to trust…

The problems of Passkeys are more nuanced than just losing access when a device is lost (which actually doesn't need to happen depending on your setup). The biggest problem are attestations, which let services block users who use tools that give them more freedom. Passkeys, or more generally challenge-response protocols, could easily have been an amazing replacement for passwords and a win-win for everyone. Unfortuna…

I'm not sure I understand all the opposition expressed in this thread about device attestation. Can someone explain it to me?

Re: Emailing a one-time code is worse than passwords

#584

Post by hombre_fatal »

philistine wrote: post #467
hombre_fatal wrote: post #438

Earlier quoted context omitted.

To add, services account for that failure by introducing something worse: a customer service backdoor where you can get into an account with very weak or nonexistent authentication. With Amazon's live chat, someone was able to get into my account by providing an address in the same city as the destination of my latest Amazon order. You see this with 2FA since "sorry lol you've lost your account forever" isn't an opti…

The solution is what's already happening, but throughly enforced: allow designated users to restore your access to your account.

Heh, that is kinda interesting and I've never heard of it before. What are some services that have this set up?

So, I guess you set up some "emergency users". And maybe if you lose access to your account, you get customer support to mark your account as lost which sends an email to the address that you have on file (in case it's an attack started by someone other than the user).

And I suppose if N days pass without any login, one of your emergency users can generate a credential that they can pass to you to recover your account?

Re: Emailing a one-time code is worse than passwords

#585

Post by mvieira38 »

thewebguyd wrote: post #552
arccy wrote: post #502

Earlier quoted context omitted.

A key part of the recent push for passkeys has been cross device syncing with your Google / Apple / whatever password manager account, so you end up in the same situation: if you can log in to Bitwarden to access your passwords, you can log in to your password manager to access your passkeys.

> A key part of the recent push for passkeys has been cross device syncing with your Google / Apple / whatever password manager account, so you end up in the same situation: if you can log in to Bitwarden to access your passwords, you can log in to your password manager to access your passkeys. Relying on Google/Apple is no better, with the stories of people losing access to their (Google in particular) account, and…

Getting the State involved is just a different, much worse threat actor than Google, though. From this discussion it should be evident how much more sovereignity passwords give you, if you want the State involved it should regulate websites' policies on passwords, such as: no service shall be hostile to password managers (special character bans, short limits on length, no pasting), no service shall require regular password resetting (proven to worsen security).

State involvement may be better used in policing, too. Public repositories of leaked passwords (without usernames, of course) would do wonders, for example

Re: Emailing a one-time code is worse than passwords

#586

Post by odo1242 »

thewebguyd wrote: post #552
arccy wrote: post #502

Earlier quoted context omitted.

A key part of the recent push for passkeys has been cross device syncing with your Google / Apple / whatever password manager account, so you end up in the same situation: if you can log in to Bitwarden to access your passwords, you can log in to your password manager to access your passkeys.

> A key part of the recent push for passkeys has been cross device syncing with your Google / Apple / whatever password manager account, so you end up in the same situation: if you can log in to Bitwarden to access your passwords, you can log in to your password manager to access your passkeys. Relying on Google/Apple is no better, with the stories of people losing access to their (Google in particular) account, and…

You can use a third-party password manager to handle passkeys. I recommend Bitwarden personally.

Re: Emailing a one-time code is worse than passwords

#587

Post by phkahler »

jvanderbot wrote: post #546
arccy wrote: post #502

Earlier quoted context omitted.

A key part of the recent push for passkeys has been cross device syncing with your Google / Apple / whatever password manager account, so you end up in the same situation: if you can log in to Bitwarden to access your passwords, you can log in to your password manager to access your passkeys.

Did people not realize they can save their 2fa token and just use that with a new authenticator? I haven't used a phone 2fa forever, but it was a much better system than this "email me a code" BS.

>> Did people not realize they can save their 2fa token and just use that with a new authenticator?

What's 2fa token? Is that an AI thing? AI uses tokens. Or a crypto thing? Do you need one of them "nonfungible" tokens? And what's an authenticator? I have MS authenticator for work, but it uses 2 digit numbers, are those tokens?

Re: Emailing a one-time code is worse than passwords

#588

Post by LVB »

FabHK wrote: post #202
internetter wrote: post #121

Earlier quoted context omitted.

I feel like this is going to bite me in the ass 15 years from now but like bcrypt is really really hard to screw up

Latacora, 2018: In order of preference, use scrypt, argon2, bcrypt, and then if nothing else is available PBKDF2. So even 7 years ago bcrypt was only the 3rd recommended option.

They follow with:

"But, seriously: you can throw a dart at a wall to pick one of these... In practice, it mostly matters that you use a real secure password hash, and not as much which one you use.

Re: Emailing a one-time code is worse than passwords

#589

Post by mouse_ »

hbn wrote: post #417
jiggawatts wrote: post #156

Earlier quoted context omitted.

I was authenticating a set of scripts five times for each run with MFA. Once, it asked me for six MFA prompts with no disambiguating info. Did I click “Yes” to the attack the fifth time, or was the sixth the attack? Or was it just a “hiccup” in the system? Do I cancel the migration job and start from the beginning or roll the dice? It’s beyond idiotic asking a Yes/No question with zero context, but that was the defau…

> “Peck at this button like a trained parrot! All of the prompts users get these days in an effort to add "security" have trained users to mindlessly say "yes" to everything just so they can access the thing they're trying to do on their computer; we've never had less secure users. The cookie tracking prompts should probably take most of the blame. I know with the last major macOS update, nearly every app is now repe…

Untold billions towards cyber security theater and there's still hackers. No one saw that coming!

Re: Emailing a one-time code is worse than passwords

#590

Post by Hackbraten »

avodonosov wrote: post #533
Hackbraten wrote: post #463

Earlier quoted context omitted.

> I know from experience that well designed messages with secure code are very understandable This premise seems flawed. How can you possibly know from experience that something is “very understandable” if the only brain you have is your own? How do you anticipate how other people with brains different from yours are going to behave in situations of cognitive impairment or extreme stress, things that happen in the re…

There are common properties of phycology shared by people. UI design and ergonomics rely on such properties. In psrticular, how people read text. But I am speaking of myself only. From experience receiving well designed message comparing to the experience with badly designed messages. I am a data point of evidence supporing my view. The opinion that "people don't read" is a complete speculation, without convincing ev…

OP’s claim was not that “people don’t read.”

It was that “[t]hey only read what they need to finish what they are currently trying to do.”

Those are two different claims.

Post reply on HN