Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Emailing a one-time code is worse than passwords

blog.danielh.cc

Post reply on HN
Print view View original

611–620 of 816 posts

Re: Emailing a one-time code is worse than passwords

#611

Post by timmyc123 »

nicce wrote: post #231
DecoPerson wrote: post #19

The attack pattern is: 1) User goes to BAD website and signs up. 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.” 3) BAD’s bots start a “Sign in with email one-time code” flow on the GOOD website using the user’s email. 4) GOOD sends a one-time login code email to the user’s email address. 5) The user is very likely to trust…

> Passkeys is the way to go. Password manager support for passkeys is getting really good. And I assure you, all passkeys being lost when a user loses their phone is far, far better than what’s been happening with passwords. I’d rather granny needs to visit the bank to get access to her account again, than someone phishes her and steals all her money. I am waiting for the era when using passkeys is not depending from…

> I am waiting for the era when using passkeys is not depending from some big tech company.

You can choose any credential manager you want to store your passkeys.

Re: Emailing a one-time code is worse than passwords

#612

Post by timmyc123 »

__MatrixMan__ wrote: post #286
DecoPerson wrote: post #19

The attack pattern is: 1) User goes to BAD website and signs up. 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.” 3) BAD’s bots start a “Sign in with email one-time code” flow on the GOOD website using the user’s email. 4) GOOD sends a one-time login code email to the user’s email address. 5) The user is very likely to trust…

Passkeys will be the way to go if we get them to remove the "attestation object" field from the protocol. Until then there's no way for Jimbob to tell the difference between: > Website: is this Jimbob' phone > Hardware: yes And > Website: I'll give you a dollar if you tell me something juicy about this user > Hardware: Give this token to Microsoft and ask them > Microsoft: Jimbob is most likely to click ads involving…

> Passkeys will be the way to go if we get them to remove the "attestation object" field from the protocol.

I don't think you understand the protocol. The attestation object does not mean there is an authenticator attestation.

There is no authenticator / credential manager attestation in the consumer synced passkey ecosystem. Period.

Re: Emailing a one-time code is worse than passwords

#613

Post by abirch »

mvieira38 wrote: post #585
thewebguyd wrote: post #552

Earlier quoted context omitted.

> A key part of the recent push for passkeys has been cross device syncing with your Google / Apple / whatever password manager account, so you end up in the same situation: if you can log in to Bitwarden to access your passwords, you can log in to your password manager to access your passkeys. Relying on Google/Apple is no better, with the stories of people losing access to their (Google in particular) account, and…

Getting the State involved is just a different, much worse threat actor than Google, though. From this discussion it should be evident how much more sovereignity passwords give you, if you want the State involved it should regulate websites' policies on passwords, such as: no service shall be hostile to password managers (special character bans, short limits on length, no pasting), no service shall require regular pa…

I use a layered approach for passwords. If I don't trust the site and they're not getting my financial information, I'm glad to use Password1234%

Google frequently warns me that one of my passwords has compromised but I don't really care for those sites.

Re: Emailing a one-time code is worse than passwords

#614

Post by palata »

valenterry wrote: post #475
jerf wrote: post #398

Earlier quoted context omitted.

I just exported my Bitwarden vault and the resulting .json file has my passkeys in it. I'm not going to try to test import, but if it doesn't work that would obviously be more "bug" than anything else. Clearly "export" is the high concern functionality and once exported, importing them is not a big deal. This is only about your first paragraph, it doesn't affect your second.

Unfortunately just because it's possible with Bitwarden doesn't mean it is always possible.

Are you saying that it's not always possible to import/export passkeys because you can manage them with some program that doesn't allow it, but the same is not true for passkeys?

Counter-example: I can write a password manager that will not allow you to export/import passwords.

Re: Emailing a one-time code is worse than passwords

#615

Post by palata »

valenterry wrote: post #178
dchest wrote: post #170

Earlier quoted context omitted.

If you like password managers, you'll love passkeys! Passkeys is an interface between your password manager and a website without all the fluff with filling or copy-pasting passwords.

No need to write like that. I know, understand and use passkeys for quite a while now. I don't love them. I don't love passwords either. But while I don't fear passwords, I fear passkeys. The reason is that it makes the tech even more intransparent. My password manager stops working, completely dies or I can't use it anymore for other reason? No problem, I can fallback to a paper list of passwords if I really have to…

Why not keeping passwords AND passkeys? Most of the time I want to use passkeys for different reasons, but if I lose my passkeys I can go back to my printed list of passwords.

Re: Emailing a one-time code is worse than passwords

#616

Post by timmyc123 »

eadmund wrote: post #293
DecoPerson wrote: post #19

The attack pattern is: 1) User goes to BAD website and signs up. 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.” 3) BAD’s bots start a “Sign in with email one-time code” flow on the GOOD website using the user’s email. 4) GOOD sends a one-time login code email to the user’s email address. 5) The user is very likely to trust…

> Passkeys is the way to go. No, please, not as long as attestation is in the spec. I firmly believe that passkeys are intended to facilitate vendor lock-in and reduce the autonomy of end users. Frankly, I do not trust any passkey implementation as much as I trust a GPG-encrypted text file.

There is no credential manager attestation in the consumer synced passkey ecosystem. Period.

Re: Emailing a one-time code is worse than passwords

#617

Post by palata »

valenterry wrote: post #479
ericjmorey wrote: post #367

Earlier quoted context omitted.

I have yet to see passkeys used as a sole method of logging in. There's always a traditional username and password setup first. There's always a recovery code set up for the passkey. I have yet to see passkeys offered as the only means of MFA. Which means that your backup methods still work. You can use them for recovering your access. I see passkeys as an optional convenience. It works well for me by that measure.

I agree, but there is no guarantee that it will stay like that. In fact, there are many people who argue to completely get rid of passwords.

This would be an argument to support keeping the passwords, instead of pushing for not adding passkeys in the first place.

And I would agree with that argument.

Re: Emailing a one-time code is worse than passwords

#618

Post by timmyc123 »

traceroute66 wrote: post #157
DecoPerson wrote: post #19

The attack pattern is: 1) User goes to BAD website and signs up. 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.” 3) BAD’s bots start a “Sign in with email one-time code” flow on the GOOD website using the user’s email. 4) GOOD sends a one-time login code email to the user’s email address. 5) The user is very likely to trust…

> Passkeys is the way to go. My problem with passkeys is that there is no hardware attestation like there is with Yubikeys and similar. This means for security conscious applications you have no way of knowing if the passkey you are dealing with is from an emulator or the real-deal. Meanwhile with Yubikeys & Co you have that. And it means that, for example people like Microsoft can (and do) offer you the option to pr…

> You can't do any of that with passkeys.

Device-bound passkeys which are used in workforce / enterprise scenarios are typically attested.

Attestation does not exist for consumer synced passkeys by design. It is an open ecosystem.

Re: Emailing a one-time code is worse than passwords

#619

Post by jonbiggums22 »

kccqzy wrote: post #591
exabrial wrote: post #488

Public Shaming: Ally Bank, made this mandatory. I'm leaving them as soon as I can find a another bank with 3.x% on savings, bill pay that automatically retrieves bill amounts, and supports _at least_ TOTP. Suggestions welcome if anyone has them.

I use Schwab (bank and brokerage). Their money market funds yields 4.x% with just a few more clicks to move into and out of the MMF. The Bill Pay retrieves the amount on my BofA credit card just fine. And it supports TOTP via Symantec VIP Access (it doesn't seem like you can use a standard TOTP app).

This is why I think people ending up locked into vendor implementations of passkeys will be a thing. We had a totally open standard, TOTP, and there were still (somewhat successful) efforts make it non-standard like the Symantec VIP Access you mentioned. How many authenticator apps do I have to install? I was hoping for one!

FWIW when I was researching this for my own accounts I believe I saw in passing that someone had figured out a way to extricate the TOTP secret from VIP Access to use in a standard TOTP app. I didn't look into it much though since none of my current accounts require it and it just seemed something to avoid.

Post reply on HN