Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Emailing a one-time code is worse than passwords

blog.danielh.cc

Post reply on HN
Print view View original

41–50 of 816 posts

Re: Emailing a one-time code is worse than passwords

#41

Post by [deleted] »

DougN7 wrote: post #22
DecoPerson wrote: post #19

The attack pattern is: 1) User goes to BAD website and signs up. 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.” 3) BAD’s bots start a “Sign in with email one-time code” flow on the GOOD website using the user’s email. 4) GOOD sends a one-time login code email to the user’s email address. 5) The user is very likely to trust…

It sounds good, unless granny needs to visit Google or Microsoft to get a new password after losing her phone. Then what??

[deleted]

Re: Emailing a one-time code is worse than passwords

#42

Post by esseph »

giantfrog wrote: post #23

Still seems far, far more likely that the average user will have their account stolen via password theft/reuse than the more complicated scheme the author is describing. Links instead of codes also fixes the issue.

Links are not trustworthy and can leak to compromise.

Re: Emailing a one-time code is worse than passwords

#43

Post by pandorobo »

donatj wrote: post #35
pandorobo wrote: post #20

Very short, badly written article. It can't even describe phishing correctly... At least label your threat model correctly. While the premise is correct -- it's easy to complain but the author also provides zero recommendations on what is a better form of MFA.

You misread the short article. It's about email as single factor auth, which has become very trendy of late. You just enter your email address, no password, and the email you a code. Access to your email is the only authentication.

Clearly I didn't misread that. It's literally the very first bullet point?

Re: Emailing a one-time code is worse than passwords

#44

Post by jjani »

Arrowmaster wrote: post #28
anonymars wrote: post #9

Earlier quoted context omitted.

I'm not familiar with this issue and a quick search didn't turn up anything obvious. Would you mind elaborating?

They are referring to the ability of a site you are logging into forcing you to use a client from a specific list or having a list of clients to deny. It's copied over from FIDO hardware keys where each device type needed to be identifiable so higher tier ones could be required or unsecured development versions could be blocked.

This is what I was referring to, and we already have seen this happen in the wild with PayPal at one point (possibly still) blocking passkeys from e.g. Firefox. For now the argument against this seems to be that "Apple zeroes this out so service providers can't do it without risking issues for their many users who use Apple to store their keys", but clearly this is so precarious of a situation it may as well not be a thing. You can't depend on one trillion-dollar company not changing their minds on that tomorrow.

Re: Emailing a one-time code is worse than passwords

#46

Post by max__dev »

pandorobo wrote: post #37
max__dev wrote: post #30

Earlier quoted context omitted.

The article is not about MFA. It is about using email as a single factor.

Thats simple a lie or you didn't read the article. The very first bullet point states: Enter an email address or phone number That insinuates email OR SMS. It doesn't just mention email only.

The following is copied from wikipedia.

The authentication factors of a multi-factor authentication scheme may include: 1. Something the user has: Any physical object in the possession of the user, such as a security token (USB stick), a bank card, a key, a phone that can be reached at a certain number, etc. 2. Something the user knows: Certain knowledge only known to the user, such as a password, PIN, PUK, etc. 3. Something the user is: Some physical characteristic of the user (biometrics), such as a fingerprint, eye iris, voice, typing speed, pattern in key press intervals, etc.

Email and phone are both in category one, comprising only one unique factor.

Re: Emailing a one-time code is worse than passwords

#48

Post by wodenokoto »

pandorobo wrote: post #20

Very short, badly written article. It can't even describe phishing correctly... At least label your threat model correctly. While the premise is correct -- it's easy to complain but the author also provides zero recommendations on what is a better form of MFA.

The article is not about multiple factor authentication.

It’s about single factor, password logins, using a one-time-token

Re: Emailing a one-time code is worse than passwords

#49

Post by eddythompson80 »

pandorobo wrote: post #38
donatj wrote: post #35

Earlier quoted context omitted.

You misread the short article. It's about email as single factor auth, which has become very trendy of late. You just enter your email address, no password, and the email you a code. Access to your email is the only authentication.

The first bullet point mentions phone number. - Enter an email address or phone number Thats not just email, that's also SMS.

Email OR SMS is still one factor. Its not multiple factors. How are you not getting that? Do you know what MFA means?

Re: Emailing a one-time code is worse than passwords

#50

Post by max__dev »

eddythompson80 wrote: post #49
pandorobo wrote: post #38

Earlier quoted context omitted.

The first bullet point mentions phone number. - Enter an email address or phone number Thats not just email, that's also SMS.

Email OR SMS is still one factor. Its not multiple factors. How are you not getting that? Do you know what MFA means?

Even if it was Email OR password, that would still be one factor due to the OR. I do not think they are discussing in good faith.
Post reply on HN