Emailing a one-time code is worse than passwords • Hacker News Board

Re: Emailing a one-time code is worse than passwords

#631

Post by efilife » Thu, Aug 07, 2025, 6:02 PM UTC

daneel_w wrote: post #338

integralid wrote: post #196

Earlier quoted context omitted.

Yeah, that's why bcrypt is broken and shouldn't be used today. It had a good run, but nowadays we have better options like scrypt or argon2.

It's not broken. It's just potentially less helpful when it comes to protecting poor guessable passwords. bcrypt isn't the problem, weak password policies/habits are. Like bcrypt, argon2 is just a bandaid, though a tiny bit thicker. It won't save you from absurdly short passwords or silly "correct horse battery staple" advice, and it's no better than bcrypt at protecting proper unguessable passwords. Also, only devel…

Why is the "correct horse battery staple" advice silly?

Re: Emailing a one-time code is worse than passwords

#632

Post by growse » Thu, Aug 07, 2025, 6:09 PM UTC

ori_b wrote: post #551

growse wrote: post #133

Earlier quoted context omitted.

> very obviously once Passkeys are everywhere it'll become "we're requiring attestation from approved device bootloaders/enclaves" This is far from very obvious, especially given that Apple have gone out of their way to not provide attestation data for keychain passkeys. Any service requiring attestation for passkeys will effectively lock out every iPhone user - not going to happen.

If there's no intention of doing this, it should be removed from the protocol. "I promise we'll never use this feature, so long as you implement it" isn't very convincing.

Not all people who want to replace passwords are running services available to the general public.

There are a bunch of service provider contexts where credential storage attestation is a really useful (and sometimes legally required!) feature.

Re: Emailing a one-time code is worse than passwords

#633

Post by toast0 » Thu, Aug 07, 2025, 6:16 PM UTC

vdfs wrote: post #534

NoGravitas wrote: post #490

Earlier quoted context omitted.

If they are doing this to 125,000 accounts, they should get an average of one account per day, right? So on average it would on average take them 342 years to get any specific account, but as long as they aren't trying for any particular account, they've got a pretty good ROI. I guess the fix for this would be exponential backoff on failed attempts instead of a static quota of 4 a day?

Why would doing this to 125K accounts give them access to one account per day? The chances of guessing 6-digtis pin code for each account is the same (10^6) regdless of how many accounts your are attacking

What are the chances of getting 500,000 guesses (4 each for 125,000 accounts) wrong ? My math says 60%, so probably not one account per day, but if they keep it up for a week and everything else holds, there's only a 3% chance they haven't gotten any codes right.

Re: Emailing a one-time code is worse than passwords

#634

Post by nobody9999 » Thu, Aug 07, 2025, 6:16 PM UTC

codedokode wrote: post #373

valenterry wrote: post #109

Earlier quoted context omitted.

> Passkeys is the way to go No, at least not on its own. Let's not repeat the mistakes. Password managers are the way to go and ONLY FOR RARE EXCEPTIONS we should use dedicated MFA, such as for email-accounts and financial stuff. And the MFA should ask you to set up at least 3 factors and ask you to use 2 or more. And if it doesn't support more or less all factors like printed codes, OS-independent authenticator apps…

Password managers are those proprietary programs that you need to install, give full access to your computer, register an account and trust their word that your passwords are uploaded to the cloud securely? No thanks. Also they are too complicated for an ordinary user. A physical key is much simpler and doesn't require any setup or thinking, and can be used on multiple devices without any configuration. And doesn't r…

>Password managers are those proprietary programs that you need to install, give full access to your computer, register an account and trust their word that your passwords are uploaded to the cloud securely? No thanks.

cf. pass(1)[0][1]

[0] https://www.passwordstore.org/

[1] No, it's not hosted in the cloud (i.e., on someone else's servers) and that's a good thing. It's FOSS and can be compiled for Android/IOS (and has, see [2][3][4], least for Android). The DB (just a GPG store) can also be shared across multiple devices.

[2] https://f-droid.org/packages/app.passwordstore.agrahn/

[3] https://play.google.com/store/apps/details?id=dev.msfjarvis....

[4] Not sure about IOS versions, I don't have any Apple devices.

Re: Emailing a one-time code is worse than passwords

#635

Post by ori_b » Thu, Aug 07, 2025, 6:19 PM UTC

growse wrote: post #632

ori_b wrote: post #551

Earlier quoted context omitted.

If there's no intention of doing this, it should be removed from the protocol. "I promise we'll never use this feature, so long as you implement it" isn't very convincing.

Not all people who want to replace passwords are running services available to the general public. There are a bunch of service provider contexts where credential storage attestation is a really useful (and sometimes legally required!) feature.

Great, they can use standards that aren't targeted at running services for the general public. It seems like the requirements already diverged.

Drop attestation from passkeys, and I become a promoter. Keep it, and I suggest people stay away.

If it's not something anyone intends to use on public services, this should be uncontroversial. Dropping attestation simplifies implementation, and makes adoption easier as a result.

Re: Emailing a one-time code is worse than passwords

#636

Post by exabrial » Thu, Aug 07, 2025, 6:21 PM UTC

kccqzy wrote: post #591

exabrial wrote: post #488

Public Shaming: Ally Bank, made this mandatory. I'm leaving them as soon as I can find a another bank with 3.x% on savings, bill pay that automatically retrieves bill amounts, and supports _at least_ TOTP. Suggestions welcome if anyone has them.

I use Schwab (bank and brokerage). Their money market funds yields 4.x% with just a few more clicks to move into and out of the MMF. The Bill Pay retrieves the amount on my BofA credit card just fine. And it supports TOTP via Symantec VIP Access (it doesn't seem like you can use a standard TOTP app).

Thanks! that's actually much closer to what I'm looking for.

pip install python-vipaccess looks like it'll provision new token, form which you can then use the secret in a regular TOTP app.

Wonder if that could be used to sidestep the proprietary app

Re: Emailing a one-time code is worse than passwords

#637

Post by exabrial » Thu, Aug 07, 2025, 6:28 PM UTC

exabrial wrote: post #636

kccqzy wrote: post #591

Earlier quoted context omitted.

I use Schwab (bank and brokerage). Their money market funds yields 4.x% with just a few more clicks to move into and out of the MMF. The Bill Pay retrieves the amount on my BofA credit card just fine. And it supports TOTP via Symantec VIP Access (it doesn't seem like you can use a standard TOTP app).

Thanks! that's actually much closer to what I'm looking for. pip install python-vipaccess looks like it'll provision new token, form which you can then use the secret in a regular TOTP app. Wonder if that could be used to sidestep the proprietary app

https://news.ycombinator.com/item?id=27692315

looks like you can!

Re: Emailing a one-time code is worse than passwords

#638

Post by nilamo » Thu, Aug 07, 2025, 6:28 PM UTC

phkahler wrote: post #587

jvanderbot wrote: post #546

Earlier quoted context omitted.

Did people not realize they can save their 2fa token and just use that with a new authenticator? I haven't used a phone 2fa forever, but it was a much better system than this "email me a code" BS.

>> Did people not realize they can save their 2fa token and just use that with a new authenticator? What's 2fa token? Is that an AI thing? AI uses tokens. Or a crypto thing? Do you need one of them "nonfungible" tokens? And what's an authenticator? I have MS authenticator for work, but it uses 2 digit numbers, are those tokens?

2fa is two factor authentication. User+password is the first factor, and is a "something you know" check. The second factor is a "something you have" check. Like sending you an SMS code.

They exist so if someone watches over your shoulder while typing your password, they don't gain access to anything.

Re: Emailing a one-time code is worse than passwords

#639

Post by 3036e4 » Thu, Aug 07, 2025, 6:29 PM UTC

chimeracoder wrote: post #493

mvieira38 wrote: post #482

Earlier quoted context omitted.

With passwords, no account was even lost in the scenario for a recovery flow to start. An account recovery flow is only necessary because of the superfluous extra security, which will almost inevitably introduce more attack vectors than before (such as a social engineering attack through customer service) if the banks want to service customers like grandmas.

> With passwords, no account was even lost in the scenario for a recovery flow to start Given how common mandatory SMS 2FA is for banks, if thieves stole your unlocked phone, they have stolen your account too.

Isn't the SMS just 1 factor, and for 2FA they will also need the other F (e.g. password)?

Relying on only SMS sounds like 1FA?

Re: Emailing a one-time code is worse than passwords

#640

Post by bsimpson » Thu, Aug 07, 2025, 6:31 PM UTC

Lukas_Skywalker wrote: post #132

iEchoic wrote: post #112

Four times a day, I get an email notification that someone requested a password reset for my Microsoft account, which gives me a six-digit number to recover my account. So every day, an attacker has four shots in 1,000,000 of stealing my account by just guessing the number. They've been doing this for years. If the attacker's doing this to thousands of accounts - which I'm sure they are - they're going to be stealing…

I have added what I think they call login alias to my account. This blocks logins using the normal account username (which is my public email address), and only allows them via the alias (which is not public and just a random string). Not a single foreign login attempt since I enabled the alias. You can enable it on account.microsoft.com > Account Info > Sign-in preferences > Add email > Add Alias and make it primary…

This sounds a lot like Steam, where the name on your profile page is a vanity string that you can change whenever you want, but the actual username in their system is an unrelated (and immutable) ID.