Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Emailing a one-time code is worse than passwords

blog.danielh.cc

Post reply on HN
Print view View original

531–540 of 816 posts

Re: Emailing a one-time code is worse than passwords

#531

Post by bccdee »

lhamil64 wrote: post #509
bccdee wrote: post #466

Earlier quoted context omitted.

FYI, you can put a 2FA secret into Bitwarden and autofill the one-time passwords alongside the regular password. That would mitigate the impact of losing your phone.

I personally don't do this because I feel like it defeats the whole purpose of 2fa. If someone gets into your bitwarden account, now they have your passwords and can generate 2fa codes. Of course, if the alternative is just not doing 2fa then it's better than nothing but I'd still prefer an authenticator app or hardware key than putting them in bitwarden.

That's why my bitwarden account is protected with 2FA! If an adversary has gotten into my bitwarden secrets, my second factor is already compromised.

And if I lose my phone, I only need to do the recovery flow with the printed codes for one account, rather than for all of my accounts.

Re: Emailing a one-time code is worse than passwords

#532

Post by danenania »

_1tem wrote: post #414
southp wrote: post #279

I get the point. However, from my own experience this type of one-time passcode is unfortunately the 2nd well-understood authentication method for non-tech people surrounding me. The 1st is the password, of course. I don't know the general situation, but, at least in our small town, people would go to the phone service shop just for account setup and recovery, since it's just too complicated. Password managers and pa…

just stick with passwords then

If you have password reset via email, as almost every service using passwords does, there’s no security gain over magic links/codes.

It’s actually worse, since now the email account or the password get you in, vs. just the email account.

Re: Emailing a one-time code is worse than passwords

#533

Post by avodonosov »

Hackbraten wrote: post #463
avodonosov wrote: post #425

Earlier quoted context omitted.

I know from experience that well designed messages with secure code are very understandable and make it virtually impossible to miss the warning. On what grounds you say people dont read? Any evidence?

> I know from experience that well designed messages with secure code are very understandable This premise seems flawed. How can you possibly know from experience that something is “very understandable” if the only brain you have is your own? How do you anticipate how other people with brains different from yours are going to behave in situations of cognitive impairment or extreme stress, things that happen in the re…

There are common properties of phycology shared by people. UI design and ergonomics rely on such properties. In psrticular, how people read text.

But I am speaking of myself only. From experience receiving well designed message comparing to the experience with badly designed messages.

I am a data point of evidence supporing my view. The opinion that "people don't read" is a complete speculation, without convincing evidence.

The real problem that many services simply not include the warning in the message.

Re: Emailing a one-time code is worse than passwords

#534

Post by vdfs »

NoGravitas wrote: post #490
iEchoic wrote: post #112

Four times a day, I get an email notification that someone requested a password reset for my Microsoft account, which gives me a six-digit number to recover my account. So every day, an attacker has four shots in 1,000,000 of stealing my account by just guessing the number. They've been doing this for years. If the attacker's doing this to thousands of accounts - which I'm sure they are - they're going to be stealing…

If they are doing this to 125,000 accounts, they should get an average of one account per day, right? So on average it would on average take them 342 years to get any specific account, but as long as they aren't trying for any particular account, they've got a pretty good ROI. I guess the fix for this would be exponential backoff on failed attempts instead of a static quota of 4 a day?

Why would doing this to 125K accounts give them access to one account per day? The chances of guessing 6-digtis pin code for each account is the same (10^6) regdless of how many accounts your are attacking

Re: Emailing a one-time code is worse than passwords

#535

Post by [deleted] »

theschmed wrote: post #402
Lukas_Skywalker wrote: post #132

Earlier quoted context omitted.

I have added what I think they call login alias to my account. This blocks logins using the normal account username (which is my public email address), and only allows them via the alias (which is not public and just a random string). Not a single foreign login attempt since I enabled the alias. You can enable it on account.microsoft.com > Account Info > Sign-in preferences > Add email > Add Alias and make it primary…

I hadn't thought of this use case for aliases. I had to make my Outlook email primary again on my Microsoft account, unfortunately, because of how I use OneDrive. I send people share invitations and there are scenarios (or at least there were the last time I checked) where sending invitations from the primary account email is the only way to deliver the invite. If your external email alias is primary, they'll attempt…

[deleted]

Re: Emailing a one-time code is worse than passwords

#536

Post by Hackbraten »

rpdillon wrote: post #458
Hackbraten wrote: post #436

Earlier quoted context omitted.

I’ve been observing this space for two decades and haven’t come across a single open-source password manager that actually works, is properly maintained, has an acceptable security track record, and comes with a similarly well-maintained browser extension that protects both my clipboard and myself from phishing.

I've been using Keepass for two decades and have never had a single issue. I would never recommend a browser plug in (too much attack surface area), and instead simply check the URL before having KeePass autotype. No clipboard. I think you're rejecting good solutions out of hand. Meanwhile...millions of users trusted LastPass. Twice.

> simply check the URL before having KeePass autotype.

I’m not going to rely on myself never making a mistake. I want a solution that protects me even during stressful moments where I have a lapse of judgement and forget to check.

Re: Emailing a one-time code is worse than passwords

#537

Post by eddythompson80 »

const_cast wrote: post #528
eddythompson80 wrote: post #59

Earlier quoted context omitted.

Anthropic is the main one. Its pushing a lot of others to do the same. I literally was arguing against that 2 weeks ago and the person who was pushing it said "Claude does that. Its really slick, no password to remember". Patreon can do that too, depending on how you sign up.

A lot of services just do this de-facto, where you only need an email code to reset the password. Which is equivalent to single auth with email. Email link to reset is better, email link + another auth (usually sms) is even better.

Only in an abstract threat model sense. In real world phishing its pretty different.

Its super odd if you land on facebook.com-profilesadfg.info/login thinking its just Facebook and try to login but get a "password reset" email. Most people would be confused as they don't want to reset their password.

Having it for every login means that just missing the website URL, everything else is 100% legit.

Re: Emailing a one-time code is worse than passwords

#538

Post by MetaWhirledPeas »

danenania wrote: post #532
_1tem wrote: post #414

Earlier quoted context omitted.

just stick with passwords then

If you have password reset via email, as almost every service using passwords does, there’s no security gain over magic links/codes. It’s actually worse, since now the email account or the password get you in, vs. just the email account.

> If you have password reset via email, as almost every service using passwords does, there’s no security gain over magic links/codes.

I disagree. The problem with the magic code is that you've trained the user to automatically enter the code without much scrutiny. If one day you're attempting to access malicious.com and you get a google.com code in your email, well you've been trained to take the code and plug it in and if you're not a smarty then you're likely to do so.

In contrast, email password recovery is an exception to the normal user flow.

Re: Emailing a one-time code is worse than passwords

#539

Post by esseph »

esseph wrote: post #42
giantfrog wrote: post #23

Still seems far, far more likely that the average user will have their account stolen via password theft/reuse than the more complicated scheme the author is describing. Links instead of codes also fixes the issue.

Links are not trustworthy and can leak to compromise.

*lead, oops!

Re: Emailing a one-time code is worse than passwords

#540

Post by anonymars »

stavros wrote: post #107
politelemon wrote: post #66

Earlier quoted context omitted.

Not really, they have no incentive to provide such a thing nor is it mandatory for them to do so.

Are you saying password managers don't have an incentive to provide a feature users want? That describes literally their entire featureset.

What incentive do they have to make it easy to migrate to a different provider?
Post reply on HN