Live data from Hacker News

Emailing a one-time code is worse than passwords

blog.danielh.cc

741–750 of 816 posts

Re: Emailing a one-time code is worse than passwords

#741

The attack pattern is: 1) User goes to BAD website and signs up. 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.” 3) BAD’s bots start a “Sign in with email one-time code” flow on the GOOD website using the user’s email. 4) GOOD sends a one-time login code email to the user’s email address. 5) The user is very likely to trust…

Good explanation! The GOOD's email should contains "Never give this code to others" and the user should know this clearly. I like phone and email OPT, it's easy to login.

Re: Emailing a one-time code is worse than passwords

#742

Earlier quoted context omitted.

Maybe im misremembering, but I feel like it gave me an option between two accounts recently? Let me see if I can get it again

Apple handles it cleanly in Safari (you get a list of the accounts you're registered with on macOS, and iOS gives you the two most-recently-used accounts for that website with a button to reveal more). The implementation in Chromium browsers (I use Arc, so I can't speak to Chrome itself) is basically a chunkier-looking 1Password.

Well if that’s what’s meant to happen, it does not happen for me. All I get is the same account over and over again that isn’t the one I want to log in with. No matter how many times I tap the little x and then select the account I want, carefully avoiding the gaze of Face ID which will automatically use the selected passkey if it spots me.

Re: Emailing a one-time code is worse than passwords

#743
post #698

Earlier quoted context omitted.

And I come back to: if it would never work, why not drop support? "We pinky promise" is just not good enough.

Is there a difference? It's a field in the response payload that nobody is filling out except the corps that need it. Would it make you feel better if they moved it to an appendix and called it an optional extension?

As long as it required an extension and extra application.

I should need to install an enterprise authenticator app, which speaks webpki-enterprise, if you want to enable that shit.

Re: Emailing a one-time code is worse than passwords

#744

Earlier quoted context omitted.

Ok. When they need the code they will have to scan through a message like Do not share the code 3456 and will read the words, because they read left to right. The code should be in the same font as the rest of the text.

I can assure you that by now, my brain is conditioned to lock into the four-digit code as soon as it can, entirely ignoring everything around it, including the words to the left. I’m an avid reader. But there are limits to what I can process, and our world has become so full of noise that it has become a coping strategy for brains to selectively ignore stuff if they feel it’s not important at the moment. That effect…

I do not believe that receiving such a message you will not notice the phrase.

And more so if you receive them constantly.

But of course, you are entitled to your opinion, even if it's wrong.

Re: Emailing a one-time code is worse than passwords

#745

Earlier quoted context omitted.

Tuesday follows Monday

I don't know if you're sarcastic or just missing the problem; which is that people will be presented with lika a facebook login page, on a site with url like `facebook.quick-login.com` or `facebock.com` and they'll enter the passcode since as fair as they were concerned, they did everything correct. The disclaimer does shit preventing that, they »obviously« didn't share the code with any other website, they entered i…

I am sarcastic because this discussion is about a different attack. Not about fishing.

(The OP says one time codes are worse than passwords. In case of fishing passwords fail the same way as one time codes.)

I was also sarcastic/provocative even in the prev comment, saying the GOOD site always includes a warning with the code making the attack impossible. A variation of the attack is very widely used by phone scammers: "Hello, we are updating intercomm on your appartment block. Please tell us your name and phone number. Ok, you will receive a code now, tell it to us". Yet many online services and banks still send one time codes without a warning to never share it!

The fishing point may also be used in defence of one time codes: if the GOOD service was using passwords instead of one time codes, the BAD could just initiated fishing attack, redirecting the user to a fake login page - people today are used to "Login with" flow.

Re: Emailing a one-time code is worse than passwords

#746
post #534

Earlier quoted context omitted.

Why would doing this to 125K accounts give them access to one account per day? The chances of guessing 6-digtis pin code for each account is the same (10^6) regdless of how many accounts your are attacking

It's never truly guaranteed and the numbers aren't quite one account per day at 125k accounts, but: 10^6 digits = 1,000,000 possibilities 125,000 accounts x 4 attempts per account per day = 500,000 attempts per day --- 1-(1-1/1,000,000)^500,000 ≈ 39% So every day they have a roughly 39% chance of success at 125,000 accounts. --- At a million accounts: 1-(1-1/1,000,000)^(4×1,000,000) ≈ 98% Pretty close to 1 account pe…

> 1-(1-1/1,000,000)^(4×1,000,000) ≈ 98%

> Pretty close to 1 account per day

No, this means there is a 98% chance you get _at least_ 1 account.

`1-1/1,000,000` is the probability you fail 1 attempt. That probability to the 4millionth is the probability you fail 4 million times in a row. 1 minus _that_ probability is that the probability that you _don't_ fail 4 million times in a row, aka that you succeed at least once.

The expected number of accounts is still number of attempts times the probability of success for 1 try, or: 4 accounts.

Re: Emailing a one-time code is worse than passwords

#747

The attack pattern is: 1) User goes to BAD website and signs up. 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.” 3) BAD’s bots start a “Sign in with email one-time code” flow on the GOOD website using the user’s email. 4) GOOD sends a one-time login code email to the user’s email address. 5) The user is very likely to trust…

I think the "click a link in the email" solution is more than a "tiny" bit better isn't it? It almost completely solves the attack pattern you laid out. Passing the whole link to BAD is not only more tedious but totally ridiculous. That is not the kind of thing that even totally naive users would do.

And there is a significant benefit of not needing to worry about weak or repeated passwords, password leaks etc.

Overall that pattern feels significantly better to me than a normal password system, and MUCH better than the "we'll send you six digits to copy and paste" solution.

Re: Emailing a one-time code is worse than passwords

#748
post #411

Earlier quoted context omitted.

The author couldn't even be bothered to write about the supposed examples of these practices being wrong. The whole thing lacks detail and actual arguments, instead we get "please stop" like it's some sort of a reddit or twitter shitpost. Look at this - https://news.ycombinator.com/item?id=44822267 - is this what this site is supposed to be now? Writing the article in the place of the author because the author couldn…

Is this what this site is supposed to be now? People ranting, complaining, and swearing about how a post submission is not what they think should be on the site? The post spawned an interesting conversation, thats worth itself alone. Go put replies like this on reddit where they belong.

Interesting conversations can also happen under articles that have actual substance, there's no need to tolerate such short blogposts just because these might spawn an interesting discussion.

Funny that you mention reddit because this is the exact same type of spam that pollutes /r/programming.

Re: Emailing a one-time code is worse than passwords

#749
post #614

Earlier quoted context omitted.

Are you saying that it's not always possible to import/export passkeys because you can manage them with some program that doesn't allow it, but the same is not true for passkeys? Counter-example: I can write a password manager that will not allow you to export/import passwords.

No, that's not what I meant. There are cases where bitwarden doesn't work but chrome for example does. Easy to Google up. For passwords however, I never heard of a case where a website only accepts passwords from a specific password manager - and how could they even do that right?

I don't think your reasoning holds. You say "I know situations where one passkey client works with some websites and not others, but I don't know situations where a website works with some clients and not others".

If the website accepts a password, then it can't prevent you from using the password manager you want. But if the website accepts FIDO2 passkeys, it's the same thing, isn't it?

Re: Emailing a one-time code is worse than passwords

#750
post #393
post #341

Earlier quoted context omitted.

On your phone

Use password manager on your phone?

I don't store my passwords on the phone. Phones are fundamentally less secure than desktop, which can use strong virtualization [0] for security.

[0] My daily driver OS is https://qubes-os.org

Post reply on HN