Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Emailing a one-time code is worse than passwords

blog.danielh.cc

Post reply on HN
Print view View original

711–720 of 816 posts

Re: Emailing a one-time code is worse than passwords

#711

Post by __MatrixMan__ »

timmyc123 wrote: post #612
__MatrixMan__ wrote: post #286

Earlier quoted context omitted.

Passkeys will be the way to go if we get them to remove the "attestation object" field from the protocol. Until then there's no way for Jimbob to tell the difference between: > Website: is this Jimbob' phone > Hardware: yes And > Website: I'll give you a dollar if you tell me something juicy about this user > Hardware: Give this token to Microsoft and ask them > Microsoft: Jimbob is most likely to click ads involving…

> Passkeys will be the way to go if we get them to remove the "attestation object" field from the protocol. I don't think you understand the protocol. The attestation object does not mean there is an authenticator attestation. There is no authenticator / credential manager attestation in the consumer synced passkey ecosystem. Period.

Is this not the protocol we're talking about? https://w3c.github.io/webauthn/#sctn-attestation

It seems pretty clear that "where possible" parties besides the user are provided with information about the user (ostensibly about their device, but who knows what implementers will use this channel for)... so they can make a trust decision.

It's going to end up being a root-of-trust play, and those create high value targets which don't hold up against corruption, so you're going to end up with a cabal of auth-providers who use their privileged position to mistreat users (which they already do, but what'll be different is that this time around nobody will trust that you're a real human unless you belong at least one member of this cabal).

Re: Emailing a one-time code is worse than passwords

#712

Post by johncolanduoni »

xg15 wrote: post #336
johncolanduoni wrote: post #298

Earlier quoted context omitted.

Why would BigTech care about the dozens of users using an open source password manager? What’s their gain from preventing these people from logging in? They love money and don’t care about user freedom, sure. But they’ve shown no evidence of hating user freedom on principle. Every time I’ve seen them actually attack user freedom, there was an embarrassingly obvious business angle. Like Chrome’s browser attestation th…

Because they'd actively have to make their proprietary passkey systems interoperable with password managers. This is fail-closed, not fail-open: If they truly didn't care, they'd also be no incentive for them to implement support. But I fear it's worse. Based on how past open standards played out, I find it believable they do care - that there won't be an open ecosystem of password managers. > But they’ve shown no ev…

They already failed then. All sides (browser->website and browser->passkey holder) of passkeys are open standards. They already don’t restrict passkeys from e.g. open source apps they have no control over, for both Google accounts and any site on Chrome. Webauthn “fails open” by default in the sense you’re indicating; if you don’t check the attestation, any app or device made by anyone can hold a passkey. I haven’t encountered or heard of anyone restricting passkey apps/hardware outside of business-managed employee accounts.

I recommend reading the MDN docs on Webauthn, they’re surprisingly accessible.

> Yes, they did, just see Microsoft's crusade against Linux and the origin of the "embrace-extend-extinguish" term.

The whole point of the trial that term came from was that Microsoft explicitly saw Linux as a material threat to their business. What threat are Google quashing by preventing you from using passkeys they don’t control?

Re: Emailing a one-time code is worse than passwords

#713

Post by johncolanduoni »

63stack wrote: post #322
johncolanduoni wrote: post #298

Earlier quoted context omitted.

Why would BigTech care about the dozens of users using an open source password manager? What’s their gain from preventing these people from logging in? They love money and don’t care about user freedom, sure. But they’ve shown no evidence of hating user freedom on principle. Every time I’ve seen them actually attack user freedom, there was an embarrassingly obvious business angle. Like Chrome’s browser attestation th…

>Why would BigTech care about the dozens of users using an open source password manager? Because big tech loves control. Just because you can't see the angle yet, it doesn't mean there isn't one now, or won't be one later. It has been shown time and time again that they will take all the freedom away from you that they can.

What instance have you seen where BigTech opted for control with no monetary incentive?

Re: Emailing a one-time code is worse than passwords

#714

Post by johncolanduoni »

bryanrasmussen wrote: post #330
johncolanduoni wrote: post #298

Earlier quoted context omitted.

Why would BigTech care about the dozens of users using an open source password manager? What’s their gain from preventing these people from logging in? They love money and don’t care about user freedom, sure. But they’ve shown no evidence of hating user freedom on principle. Every time I’ve seen them actually attack user freedom, there was an embarrassingly obvious business angle. Like Chrome’s browser attestation th…

>Why would BigTech care about the dozens of users using an open source password manager? I agree, why would BigTech care about those dozens of users. Screw those guys, they can use our password manager or they can get lost, we don't need them!

They already let the open source password managers work just fine with every facet of passkeys. Why would they reverse this now, was my point.

Re: Emailing a one-time code is worse than passwords

#716

Post by valenterry »

palata wrote: post #614
valenterry wrote: post #475

Earlier quoted context omitted.

Unfortunately just because it's possible with Bitwarden doesn't mean it is always possible.

Are you saying that it's not always possible to import/export passkeys because you can manage them with some program that doesn't allow it, but the same is not true for passkeys? Counter-example: I can write a password manager that will not allow you to export/import passwords.

No, that's not what I meant.

There are cases where bitwarden doesn't work but chrome for example does. Easy to Google up.

For passwords however, I never heard of a case where a website only accepts passwords from a specific password manager - and how could they even do that right?

Re: Emailing a one-time code is worse than passwords

#717

Post by valenterry »

palata wrote: post #617
valenterry wrote: post #479

Earlier quoted context omitted.

I agree, but there is no guarantee that it will stay like that. In fact, there are many people who argue to completely get rid of passwords.

This would be an argument to support keeping the passwords, instead of pushing for not adding passkeys in the first place. And I would agree with that argument.

Which is exactly what I said.

Re: Emailing a one-time code is worse than passwords

#718

Post by danenania »

MetaWhirledPeas wrote: post #538
danenania wrote: post #532

Earlier quoted context omitted.

If you have password reset via email, as almost every service using passwords does, there’s no security gain over magic links/codes. It’s actually worse, since now the email account or the password get you in, vs. just the email account.

> If you have password reset via email, as almost every service using passwords does, there’s no security gain over magic links/codes. I disagree. The problem with the magic code is that you've trained the user to automatically enter the code without much scrutiny. If one day you're attempting to access malicious.com and you get a google.com code in your email, well you've been trained to take the code and plug it in…

Password reset also has phishing potential. I do see your point, but if a user doesn’t check domains, I think they can be easily phished through either route.

Re: Emailing a one-time code is worse than passwords

#719

Post by bryan_w »

ori_b wrote: post #698
growse wrote: post #691

Earlier quoted context omitted.

> If you make something possible, it will be used. Sure, but that's not without tradeoffs. I come back to: > Any service requiring attestation for passkeys will effectively lock out every iPhone user - not going to happen.

And I come back to: if it would never work, why not drop support? "We pinky promise" is just not good enough.

Is there a difference? It's a field in the response payload that nobody is filling out except the corps that need it. Would it make you feel better if they moved it to an appendix and called it an optional extension?

Re: Emailing a one-time code is worse than passwords

#720

Post by phendrenad2 »

DecoPerson wrote: post #19

The attack pattern is: 1) User goes to BAD website and signs up. 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.” 3) BAD’s bots start a “Sign in with email one-time code” flow on the GOOD website using the user’s email. 4) GOOD sends a one-time login code email to the user’s email address. 5) The user is very likely to trust…

> “Click a link in the email” is a tiny bit better because it takes the user straight to the GOOD website

I don't know, some would say taking an attack from trivial to virtually impossible is a bit more than a "tiny bit".

Post reply on HN