Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Emailing a one-time code is worse than passwords

blog.danielh.cc

Post reply on HN
Print view View original

251–260 of 816 posts

Re: Emailing a one-time code is worse than passwords

#251

Post by j1elo »

charcircuit wrote: post #233
patrakov wrote: post #116

Earlier quoted context omitted.

The scary part is not about losing her phone. It's about having to keep the old, no-longer-secure Android phone alive just for passkeys after getting a shiny (and secure) new iPhone.

You can add the new phone as an additional passkey. I don't see how this would be scary.

I have 531 logins for varied websites and services. Would you enjoy having to change 531 passkey devices? Me neither. But default login flows in all these sites prompt you to use your current device as passkey by default, so people who don't know better (i.e. a general "everybody") are being gently pushed to do so.

Re: Emailing a one-time code is worse than passwords

#252

Post by trinix912 »

antirez wrote: post #216
Angostura wrote: post #208

I read this sentence 4 times and I still can't parse it: > An attacker can simply send your email address to a legitimate service, and prompt for a 6-digit code. You can't know for sure if the code is supposed to be entered in the right place.

Because the sentence makes no sense, but what the author wanted to say was: - You are in front of the attacker site that looks like a legitimate site where you have an account (you arrived there in any way: Whatsapp link, SMS, email, whatever). Probably the address bar of your browser shows something like microsoft.minecraft-softwareupdate.com or something alike, but the random user can't tell it's fake. The page ask…

I think one can also understand it as the attacker being the one to enter the email first.

> An attacker can simply send your email address to a legitimate service, and prompt for a 6-digit code. You can't know for sure if the code is supposed to be entered in the right place.

Replace "can simply send your email address" with "can simply input your email address". An attacked inputs your email at login.example.com, which sends a code to your email. The attacker then prompts you for that code (ex. via a phishing sms), so you pass them the code that lets them into the account.

Re: Emailing a one-time code is worse than passwords

#253

Post by hendry »

Nevor wrote: post #249

There are some short comings about using email codes but I fail to see how this worse than passwords when the same exact kind of attack would work for passwords. The difference being that it would be worse with passwords which can be stored, reused later or sometimes changed directly on the service.

I came to the comments to say this. Nevor and I are one.

Re: Emailing a one-time code is worse than passwords

#254

Post by valenterry »

syhol wrote: post #244
valenterry wrote: post #178

Earlier quoted context omitted.

No need to write like that. I know, understand and use passkeys for quite a while now. I don't love them. I don't love passwords either. But while I don't fear passwords, I fear passkeys. The reason is that it makes the tech even more intransparent. My password manager stops working, completely dies or I can't use it anymore for other reason? No problem, I can fallback to a paper list of passwords if I really have to…

A passkey import/export standard is in the works. Once I know I can backup everything in a keepass database I'll be much happier.

True. Still, the difference is that with passwords, no one can stop you from "exporting" it. With passkeys, it could be changed, and the power for that lies in the hands of only a few vendors. It's still a bit concerning if they replace passwords forcefully.

Re: Emailing a one-time code is worse than passwords

#255

Post by charcircuit »

t_mann wrote: post #105
drdaeman wrote: post #96

Earlier quoted context omitted.

At the very least the spec should be painstakingly insistent on not requiring attestation unless implementors have really thought and understood the reasons why they need the security properties provided by attestation in their particular use case. And that it has to be something more meaningful than “be more secure this way” as security is not a rating (even though security ratings exist) but a set of properties, an…

I agree, but unfortunately the spec authors are already going out and dangling possible bans in front of projects who implement Passkeys in more user-friendly ways: https://github.com/keepassxreboot/keepassxc/issues/10407 > To be very honest here, you risk having KeePassXC blocked by relying parties But having a choice about how you store your credentials shouldn't depend on the good faith of service providers or the…

Reducing passkeys to the security level of passwords is not just "making something user friendly". It's undoing all of the hardware everyone else in the ecosystem is putting into to making a more secure way for authentication to be done.

Re: Emailing a one-time code is worse than passwords

#256

Post by xobs »

geden wrote: post #126
yoz-y wrote: post #103

Earlier quoted context omitted.

I don’t like passkeys. Before my process to login was: - open website - if not already logged in, log in to 1Password - autofill password - autofill TOTP Now: - open website - if logged in to 1Password the Use Passkey usually shows up - if not: - log in to 1Password - choose use passkey - this almost always does nothing - choose “use other method” - choose “password” - autofill that - now there is another dialog to c…

Passkeys work very smoothly with Safari and Apple Passwords. Apple Passwords now sufficiently good to replace 1Password for me and I’m slowly transitioning. I don’t mind subscription models per se but there was something about subscription for your own passwords that made me refuse to jump the fence when 1Password switched to that model. Would be a bit faffy if you’re a Chrome user.

I've never gotten passkeys to work on the Mac. Every time I try it with either Firefox or Safari says I need to log into iCloud, which I really don't want.

Re: Emailing a one-time code is worse than passwords

#257

Post by j1elo »

dominicrose wrote: post #190
DecoPerson wrote: post #19

The attack pattern is: 1) User goes to BAD website and signs up. 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.” 3) BAD’s bots start a “Sign in with email one-time code” flow on the GOOD website using the user’s email. 4) GOOD sends a one-time login code email to the user’s email address. 5) The user is very likely to trust…

I'm not sure what kind of websites are vulnerable to these attacks, but websites that have double authentication seem pretty safe to me. And if you forgot your password, then you receive an e-mail to change it with a secure link. This point means the user is not paying attention: 1) User goes to BAD website and signs up. Steps 2-7 wouldn't be possible without 1.

"User not paying attention" is ultimately the reason for most phising attacks. It happens a lot, and we're trying to solve it as the known problem it is. Everybody, and I say everybody are human beings at the end of the day (so far...) and so by definition, can have a bad day and lower their defenses. It has ironically even happened to reputated security specialists.

Re: Emailing a one-time code is worse than passwords

#259

Post by Yizahi »

DecoPerson wrote: post #19

The attack pattern is: 1) User goes to BAD website and signs up. 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.” 3) BAD’s bots start a “Sign in with email one-time code” flow on the GOOD website using the user’s email. 4) GOOD sends a one-time login code email to the user’s email address. 5) The user is very likely to trust…

If attacker would fool me at one website he will get that one account (possibly forever) and that's it. If it is a bank connected account, I can intervene and change email/account by writing a physical request to the bank for example, call the bank, do something. And likely it will be only a single bank account. But it may be even some unrelated account. Maybe it will be my Amazon account and all the attacker gets is some ebooks. Or Steam account. Or some email without important links. Etc.

Point is, the damage will be likely local to a single or a handful of accounts.

If all the accounts are protected by two factor on my phone and I lose it or it bricks, then I'm done. It will be a total mess with no paths to recover, except restarting literally everything from scratch.

I have Google Auth app on my phone and every few months I consider using it, but then reconsider and stay with passwords.

Re: Emailing a one-time code is worse than passwords

#260

Post by Randor »

iEchoic wrote: post #112

Four times a day, I get an email notification that someone requested a password reset for my Microsoft account, which gives me a six-digit number to recover my account. So every day, an attacker has four shots in 1,000,000 of stealing my account by just guessing the number. They've been doing this for years. If the attacker's doing this to thousands of accounts - which I'm sure they are - they're going to be stealing…

Microsoft allows you create a second "login only" account username to access your e-mail and other services. I was having the same problem as you but much worse. Check into it, only takes a few minutes to setup.
Post reply on HN