The attack pattern is: 1) User goes to BAD website and signs up. 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.” 3) BAD’s bots start a “Sign in with email one-time code” flow on the GOOD website using the user’s email. 4) GOOD sends a one-time login code email to the user’s email address. 5) The user is very likely to trust…
Emailing a one-time code is worse than passwords
741–750 of 816 posts
Re: Emailing a one-time code is worse than passwords
#742Earlier quoted context omitted.
Maybe im misremembering, but I feel like it gave me an option between two accounts recently? Let me see if I can get it again
Apple handles it cleanly in Safari (you get a list of the accounts you're registered with on macOS, and iOS gives you the two most-recently-used accounts for that website with a button to reveal more). The implementation in Chromium browsers (I use Arc, so I can't speak to Chrome itself) is basically a chunkier-looking 1Password.
Re: Emailing a one-time code is worse than passwords
#743Earlier quoted context omitted.
And I come back to: if it would never work, why not drop support? "We pinky promise" is just not good enough.
Is there a difference? It's a field in the response payload that nobody is filling out except the corps that need it. Would it make you feel better if they moved it to an appendix and called it an optional extension?
I should need to install an enterprise authenticator app, which speaks webpki-enterprise, if you want to enable that shit.
Re: Emailing a one-time code is worse than passwords
#744Earlier quoted context omitted.
Ok. When they need the code they will have to scan through a message like Do not share the code 3456 and will read the words, because they read left to right. The code should be in the same font as the rest of the text.
I can assure you that by now, my brain is conditioned to lock into the four-digit code as soon as it can, entirely ignoring everything around it, including the words to the left. I’m an avid reader. But there are limits to what I can process, and our world has become so full of noise that it has become a coping strategy for brains to selectively ignore stuff if they feel it’s not important at the moment. That effect…
And more so if you receive them constantly.
But of course, you are entitled to your opinion, even if it's wrong.
Re: Emailing a one-time code is worse than passwords
#745Earlier quoted context omitted.
Tuesday follows Monday
I don't know if you're sarcastic or just missing the problem; which is that people will be presented with lika a facebook login page, on a site with url like `facebook.quick-login.com` or `facebock.com` and they'll enter the passcode since as fair as they were concerned, they did everything correct. The disclaimer does shit preventing that, they »obviously« didn't share the code with any other website, they entered i…
(The OP says one time codes are worse than passwords. In case of fishing passwords fail the same way as one time codes.)
I was also sarcastic/provocative even in the prev comment, saying the GOOD site always includes a warning with the code making the attack impossible. A variation of the attack is very widely used by phone scammers: "Hello, we are updating intercomm on your appartment block. Please tell us your name and phone number. Ok, you will receive a code now, tell it to us". Yet many online services and banks still send one time codes without a warning to never share it!
The fishing point may also be used in defence of one time codes: if the GOOD service was using passwords instead of one time codes, the BAD could just initiated fishing attack, redirecting the user to a fake login page - people today are used to "Login with" flow.
Re: Emailing a one-time code is worse than passwords
#746Earlier quoted context omitted.
Why would doing this to 125K accounts give them access to one account per day? The chances of guessing 6-digtis pin code for each account is the same (10^6) regdless of how many accounts your are attacking
It's never truly guaranteed and the numbers aren't quite one account per day at 125k accounts, but: 10^6 digits = 1,000,000 possibilities 125,000 accounts x 4 attempts per account per day = 500,000 attempts per day --- 1-(1-1/1,000,000)^500,000 ≈ 39% So every day they have a roughly 39% chance of success at 125,000 accounts. --- At a million accounts: 1-(1-1/1,000,000)^(4×1,000,000) ≈ 98% Pretty close to 1 account pe…
> Pretty close to 1 account per day
No, this means there is a 98% chance you get _at least_ 1 account.
`1-1/1,000,000` is the probability you fail 1 attempt. That probability to the 4millionth is the probability you fail 4 million times in a row. 1 minus _that_ probability is that the probability that you _don't_ fail 4 million times in a row, aka that you succeed at least once.
The expected number of accounts is still number of attempts times the probability of success for 1 try, or: 4 accounts.
Re: Emailing a one-time code is worse than passwords
#747The attack pattern is: 1) User goes to BAD website and signs up. 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.” 3) BAD’s bots start a “Sign in with email one-time code” flow on the GOOD website using the user’s email. 4) GOOD sends a one-time login code email to the user’s email address. 5) The user is very likely to trust…
And there is a significant benefit of not needing to worry about weak or repeated passwords, password leaks etc.
Overall that pattern feels significantly better to me than a normal password system, and MUCH better than the "we'll send you six digits to copy and paste" solution.
Re: Emailing a one-time code is worse than passwords
#748Earlier quoted context omitted.
The author couldn't even be bothered to write about the supposed examples of these practices being wrong. The whole thing lacks detail and actual arguments, instead we get "please stop" like it's some sort of a reddit or twitter shitpost. Look at this - https://news.ycombinator.com/item?id=44822267 - is this what this site is supposed to be now? Writing the article in the place of the author because the author couldn…
Is this what this site is supposed to be now? People ranting, complaining, and swearing about how a post submission is not what they think should be on the site? The post spawned an interesting conversation, thats worth itself alone. Go put replies like this on reddit where they belong.
Funny that you mention reddit because this is the exact same type of spam that pollutes /r/programming.
Re: Emailing a one-time code is worse than passwords
#749Earlier quoted context omitted.
Are you saying that it's not always possible to import/export passkeys because you can manage them with some program that doesn't allow it, but the same is not true for passkeys? Counter-example: I can write a password manager that will not allow you to export/import passwords.
No, that's not what I meant. There are cases where bitwarden doesn't work but chrome for example does. Easy to Google up. For passwords however, I never heard of a case where a website only accepts passwords from a specific password manager - and how could they even do that right?
If the website accepts a password, then it can't prevent you from using the password manager you want. But if the website accepts FIDO2 passkeys, it's the same thing, isn't it?
Re: Emailing a one-time code is worse than passwords
#750Earlier quoted context omitted.
On your phone
Use password manager on your phone?
[0] My daily driver OS is https://qubes-os.org