Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Emailing a one-time code is worse than passwords

blog.danielh.cc

Post reply on HN
Print view View original

661–670 of 816 posts

Re: Emailing a one-time code is worse than passwords

#661

Post by jorams »

timmyc123 wrote: post #604
lelandbatey wrote: post #507

Earlier quoted context omitted.

The Fido2 folks really really want things to be so secure and centralized, with so little user freedom, and they want to use attestation to do it. Here's a Fido2 member (Okta) employee saying "If keepass allows users to back up passkeys to paper, I think we'll have to allow providers to block keepass via attestation." https://github.com/keepassxreboot/keepassxc/issues/10407#iss... All because passkeys backup is deeme…

Hi, since you mentioned me, that's not what was said and putting it in quotes as if I did is really inappropriate. I'll post the same response I replied to other on a different thread: Wild that you (and a few others) continue to make these accusations about me in these comments (and in other venues). 1) I've been one of the most vocal proponents of synced passkeys never being attested to ensure users can use the cre…

They paraphrased what you said in the thread, but I don't think it's much of a misrepresentation.

You may have "been one of the most vocal proponents of synced passkeys never being attested to ensure users can use the credential manager of their choice", but as soon as one such credential manager allows export that becomes "something that I have previously rallied against but rethinking as of late because of these situations".

There may not currently be attestation in the consumer synced passkey ecosystem, but in the issue thread you say "you risk having KeePassXC blocked by relying parties".

The fact that that possibility exists, and that the feature of allowing passkeys to be exported is enough to bring it up, is a huge problem. Especially if it's coming from "one of the most vocal proponents of synced passkeys never being attested", because that says a lot about whoever else is involved in protocol development.

Re: Emailing a one-time code is worse than passwords

#662

Post by kube-system »

FuriouslyAdrift wrote: post #514
janfromdaito wrote: post #406

Earlier quoted context omitted.

What were those "massive problems"?

Re-imaged, lost, or bad updates on PCs wiping out a all the saved passkeys and being locked out of all accounts during off-campus sales or design meetings. Making staff look like idiots in front of clients is a resume-generating-event.

Yeah, 'availability' is a huge pillar of computer security that many people forget exists.

Re: Emailing a one-time code is worse than passwords

#663

Post by growse »

ori_b wrote: post #635
growse wrote: post #632

Earlier quoted context omitted.

Not all people who want to replace passwords are running services available to the general public. There are a bunch of service provider contexts where credential storage attestation is a really useful (and sometimes legally required!) feature.

Great, they can use standards that aren't targeted at running services for the general public. It seems like the requirements already diverged. Drop attestation from passkeys, and I become a promoter. Keep it, and I suggest people stay away. If it's not something anyone intends to use on public services, this should be uncontroversial. Dropping attestation simplifies implementation, and makes adoption easier as a res…

What makes you think that the Webauthn standards are "targeted at running services for the general public"?

> It seems like the requirements already diverged.

No, the requirements are _contextual_. This isn't a new idea.

Re: Emailing a one-time code is worse than passwords

#664

Post by hbn »

mouse_ wrote: post #589
hbn wrote: post #417

Earlier quoted context omitted.

> “Peck at this button like a trained parrot! All of the prompts users get these days in an effort to add "security" have trained users to mindlessly say "yes" to everything just so they can access the thing they're trying to do on their computer; we've never had less secure users. The cookie tracking prompts should probably take most of the blame. I know with the last major macOS update, nearly every app is now repe…

Untold billions towards cyber security theater and there's still hackers. No one saw that coming!

I'd make a joke about cybersecurity theatre but I think zscaler will block the comment from being submitted

Re: Emailing a one-time code is worse than passwords

#665

Post by ori_b »

growse wrote: post #663
ori_b wrote: post #635

Earlier quoted context omitted.

Great, they can use standards that aren't targeted at running services for the general public. It seems like the requirements already diverged. Drop attestation from passkeys, and I become a promoter. Keep it, and I suggest people stay away. If it's not something anyone intends to use on public services, this should be uncontroversial. Dropping attestation simplifies implementation, and makes adoption easier as a res…

What makes you think that the Webauthn standards are "targeted at running services for the general public"? > It seems like the requirements already diverged. No, the requirements are _contextual_. This isn't a new idea.

The fact that sites targeted at the general public are prompting me to use them. Should websites avoid using passkeys and webauthn? Would you like to tell them that they're doing it wrong?

Re: Emailing a one-time code is worse than passwords

#667

Post by ewoodrich »

elteto wrote: post #301
charcircuit wrote: post #272

Earlier quoted context omitted.

No, which is why there is the cross platform standard CXF which allows for cross platform sharing of passkeys. Apple has announced that support for this is shipping later this year with iOS 26. Google hasn't announced when they are shipping it yet.

So until then you have to do what parent said? Change each one individually when you switch devices? Thanks but no.

I keep all my Passkeys in Bitwarden, it works fine across different devices and I use all major platforms regularly (iOS, Android, Windows, MacOS, ChromeOS). As a backup I've also added some extra duplicate Passkeys in the Chrome and iCloud password manager for the most important accounts in case I lose access to Bitwarden somehow.

Re: Emailing a one-time code is worse than passwords

#669

Post by umbra07 »

forgetfreeman wrote: post #647
umbra07 wrote: post #642

Earlier quoted context omitted.

So then the State can see what services I've signed up for, when and where? The State is always more difficult and dangerous to deal with than a private company.

"The State is always more difficult and dangerous to deal with than a private company." Ridiculous.

Of course it is.

Google can ban me (really just one specific digital instance of me) from their services. The government can throw me in jail, take all my property, fine me whatever amount they want, etc.

Re: Emailing a one-time code is worse than passwords

#670

Post by daneel_w »

efilife wrote: post #631
daneel_w wrote: post #338

Earlier quoted context omitted.

It's not broken. It's just potentially less helpful when it comes to protecting poor guessable passwords. bcrypt isn't the problem, weak password policies/habits are. Like bcrypt, argon2 is just a bandaid, though a tiny bit thicker. It won't save you from absurdly short passwords or silly "correct horse battery staple" advice, and it's no better than bcrypt at protecting proper unguessable passwords. Also, only devel…

Why is the "correct horse battery staple" advice silly?

Using memorable passphrases online is always a bad option because they're easily broken with a dictionary attack, unless you bump the number of words to the point where it becomes hard to remember the phrase. Use long strings of random characters instead, and contain the use of passphrases to unlocking your password manager.
Post reply on HN