Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Emailing a one-time code is worse than passwords

blog.danielh.cc

Post reply on HN
Print view View original

591–600 of 816 posts

Re: Emailing a one-time code is worse than passwords

#591

Post by kccqzy »

exabrial wrote: post #488

Public Shaming: Ally Bank, made this mandatory. I'm leaving them as soon as I can find a another bank with 3.x% on savings, bill pay that automatically retrieves bill amounts, and supports _at least_ TOTP. Suggestions welcome if anyone has them.

I use Schwab (bank and brokerage). Their money market funds yields 4.x% with just a few more clicks to move into and out of the MMF. The Bill Pay retrieves the amount on my BofA credit card just fine. And it supports TOTP via Symantec VIP Access (it doesn't seem like you can use a standard TOTP app).

Re: Emailing a one-time code is worse than passwords

#592

Post by ascorbic »

gethly wrote: post #523
ascorbic wrote: post #79

Earlier quoted context omitted.

The evil site usually says something like "enter the code from our identity partner x" or something, which is a lot more believable when it's a service like Microsoft that does provide services like that.

That is not how oAuth works.

That's the point: this isn't OAuth. It's just a way to phish the code.

Re: Emailing a one-time code is worse than passwords

#593

Post by dsr_ »

jamespo wrote: post #525
dare944 wrote: post #512

Earlier quoted context omitted.

Grandma is self-hosting what???

that's where you come in sonny

This.

Grandma, and Uncle Rob, and your cousins, and anyone else you have a long standing relationship with, can use your VaultWarden instance if you let them.

But! You now get to maintain uptime (Rob travels and is frequently awake at 3am your time) and make sure that the backups are working... and remember that their access to their bank accounts is now in your hands, so be responsible. Have a second site and teach your niece how to sysadmin.

Re: Emailing a one-time code is worse than passwords

#594

Post by bangaladore »

This is a fundamental flaw with any login flow that is not phishing resistant. There is nothing novel about this attack.

An attacker can register a domain like office375.com, clone Microsoft's login page, and relay user input to the real site. This works even with various forms of MFA, because the victim willingly enters both their credentials and second factor into a fake site. Push-based MFA is starting to show IP and location data, but a non-technical user likely won’t notice or understand the warning and a sophisticated attacker will just use a VPN matching the users' location anyways.

Passkeys solve this problem through origin enforcement. Your browser will not let you use a passkey for an origin that the passkey was not created for. If they did, you could relay those challenges as well (still better than user + pass as the challenges are useless after first use).

Re: Emailing a one-time code is worse than passwords

#595

Post by SethMurphy »

chii wrote: post #171
jddj wrote: post #108

Earlier quoted context omitted.

In practice it's maybe slightly harder, because they'd have to convince a user to enter their google 2fa code into a site that isn't obviously google? I'd imagine a convincing enough modal would do the trick though, in a lot of cases.

> convince a user to enter their google 2fa code into a site that isn't obviously google? if the BAD site itself looks legit, and has convinced a user to do the initial login in the first place, they won't hesitate to lie and say that this 2-factor code is part of their partnership with google etc, and tells you to trust it. A normal user doesn't understand what is a 2factor code, how it works, and such. They will ea…

What I don't understand is how the site will send the 2FA code request to the bad actors phone, instead of the real users phone? Is this not part of what makes it more secure than a text or email? Wouldn't the bad actor need to be logged into the authenticator as the user your trying to hack?

Re: Emailing a one-time code is worse than passwords

#596

Post by rconti »

DecoPerson wrote: post #19

The attack pattern is: 1) User goes to BAD website and signs up. 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.” 3) BAD’s bots start a “Sign in with email one-time code” flow on the GOOD website using the user’s email. 4) GOOD sends a one-time login code email to the user’s email address. 5) The user is very likely to trust…

Passkeys are a usability nightmare. No two experiences are ever the same. I have passkeys saved in 1Password and in Apple Passwords. I have a YubiKey. I have Duo on my work computer.

A common experience is Chrome telling me to scan a QR code. But I know this is not a legitimate method to sign in on any service _I_ use. I also never know WHY I'm being told to "scan this QR code". I scan it, and my phone also has no idea what to do with it! The site has decided, by not finding a passkey where it expects it, that it MUST be on my phone.

That's but one example of the horrible implementation, horribly usability, and horrible guidance various sites/applications/browsers/implementations use.

Re: Emailing a one-time code is worse than passwords

#597

Post by LorenPechtel »

mvieira38 wrote: post #448
DecoPerson wrote: post #19

The attack pattern is: 1) User goes to BAD website and signs up. 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.” 3) BAD’s bots start a “Sign in with email one-time code” flow on the GOOD website using the user’s email. 4) GOOD sends a one-time login code email to the user’s email address. 5) The user is very likely to trust…

>"I’d rather granny needs to visit the bank to get access to her account again, than someone phishes her and steals all her money." More like abuelita gets robbed at gunpoint and made to unlock and clear out her bank account, then has no recourse at home because her device was taken. I live in a third world country and even 2FA simply isn't viable for me due to how frequent phone robberies are. I've had to do the pro…

Exactly. The only financial stuff on my phone is Google Wallet and I don't even live in a high threat area. The devices that can accept payment from Google Wallet are always in observed locations, it would be very hard for a mugger to use it maliciously. All the easy money transfer options are an attack surface I see no need to expose.

Re: Emailing a one-time code is worse than passwords

#598

Post by bArray »

I think I have said the following till I go blue in the face:

1. Mobile phone numbers are not secure. SIM jacking is a thing, and a 6 digit code is not impossible to guess (it's only 1 in a million).

2. Sending codes/links via email is problematic as described by the article.

3. Inconsistent "best practices" confuse users, and frustrate them.

Re: Emailing a one-time code is worse than passwords

#599

Post by Wingman4l7 »

stronglikedan wrote: post #543
_1tem wrote: post #414

Earlier quoted context omitted.

just stick with passwords then

Good luck finding a suite of modern, convenient services that will allow you to do that nowadays. I wish we could opt-in with some sort of I-know-what-I'm-doing-with-passwords-and-take-full-responsibility option.

You vastly underestimate the number of people who should not pick this option but would (because doing otherwise would be admitting their incompetence / ignorance) -- thus handily continuing the problem.

Re: Emailing a one-time code is worse than passwords

#600

Post by odo1242 »

johncolanduoni wrote: post #308
uyzstvqs wrote: post #292

Earlier quoted context omitted.

Passkeys are the pinnacle of bad UX. It just works, until the user tries to switch devices, accounts or platforms. The slogan of passkeys should be something like "I don't have a password, it usually just works, but now I changed X and it doesn't work anymore" . Even worse is hardware-based 2FA built into smartphones (also FIDO), as you lose your phone in a lake and now you can't access anything anymore. The way to g…

Apple’s works fine, including when I’m logging on to my windows machine. Opening the camera app is a little annoying, but I don’t have to do it frequently. 1Password works well too and it runs on everything. There’s open source options, but I can’t attest to their UX.

Bitwarden is really good for passkeys, better than apple's password manager imo
Post reply on HN