Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Emailing a one-time code is worse than passwords

blog.danielh.cc

Post reply on HN
Print view View original

781–790 of 816 posts

Re: Emailing a one-time code is worse than passwords

#781

Post by zaptheimpaler »

DecoPerson wrote: post #19

The attack pattern is: 1) User goes to BAD website and signs up. 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.” 3) BAD’s bots start a “Sign in with email one-time code” flow on the GOOD website using the user’s email. 4) GOOD sends a one-time login code email to the user’s email address. 5) The user is very likely to trust…

Or I could keep using passwords in my password manager, where I DON’T lose all my passwords if I lose my phone? Passkeys just seem to solve no real problems and create a black box dependency. Everything I’ve seen about them just makes no damn sense.

Re: Emailing a one-time code is worse than passwords

#782

Post by zaptheimpaler »

hshdhdhj4444 wrote: post #410
DecoPerson wrote: post #19

The attack pattern is: 1) User goes to BAD website and signs up. 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.” 3) BAD’s bots start a “Sign in with email one-time code” flow on the GOOD website using the user’s email. 4) GOOD sends a one-time login code email to the user’s email address. 5) The user is very likely to trust…

This comment explains why passkeys are nothing more than a way to shift responsibility. If you lose all your data and your entire life because you lost your phone, no company is responsible. But if you get hacked they are. So they’ve come up with a solution that can destroy your entire life, but reduces the risk of corporate liability. But yeah, keep carrying water for the entities that won’t come up with actual user…

Yes that’s what 99% of modern security is. Anything that requires O(N) spending for N users must be thrown away in the name of stock prices.

Re: Emailing a one-time code is worse than passwords

#783

Post by philistine »

hombre_fatal wrote: post #584
philistine wrote: post #467

Earlier quoted context omitted.

The solution is what's already happening, but throughly enforced: allow designated users to restore your access to your account.

Heh, that is kinda interesting and I've never heard of it before. What are some services that have this set up? So, I guess you set up some "emergency users". And maybe if you lose access to your account, you get customer support to mark your account as lost which sends an email to the address that you have on file (in case it's an attack started by someone other than the user). And I suppose if N days pass without a…

Apple accounts have had it for years. You can set up a legal successor if you die, and a couple of people who can vouch for you to regain access.

That and Apple will give you a very long one-time password meant to be printed that can restore access as well. This one is in a third undisclosed location for me.

Re: Emailing a one-time code is worse than passwords

#784

Post by Ey7NFZ3P0nzAe »

DecoPerson wrote: post #19

The attack pattern is: 1) User goes to BAD website and signs up. 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.” 3) BAD’s bots start a “Sign in with email one-time code” flow on the GOOD website using the user’s email. 4) GOOD sends a one-time login code email to the user’s email address. 5) The user is very likely to trust…

For those like me needing a refresher on passkeys: https://www.passkeys.com/

Re: Emailing a one-time code is worse than passwords

#785

Post by palata »

valenterry wrote: post #758
palata wrote: post #749

Earlier quoted context omitted.

I don't think your reasoning holds. You say "I know situations where one passkey client works with some websites and not others, but I don't know situations where a website works with some clients and not others". If the website accepts a password, then it can't prevent you from using the password manager you want. But if the website accepts FIDO2 passkeys, it's the same thing, isn't it?

> but I don't know situations where a website works with some clients and not others For example: https://www.w3.org/TR/webauthn-2/#dictdef-authenticatorselec... > If the website accepts a password, then it can't prevent you from using the password manager you want. But if the website accepts FIDO2 passkeys, it's the same thing, isn't it? Unfortunately not...

> For example: [...]

Those sound like requirements similar to those that can be enforced with passwords. My company enforces an SSO system with an MFA scheme that is controlled by the IT department. I can use my password manager for the password part, but I must use the mandatory MFA app.

In that sense, I am not sure it is so different from passkeys?

Re: Emailing a one-time code is worse than passwords

#786

Post by palata »

abustamam wrote: post #727
palata wrote: post #609

Earlier quoted context omitted.

I've seen that kind of comments multiple times, and I don't get it. I use Yubikeys, and passkeys just work. On Chrome, Firefox and Safari, both on macOS and Linux (specifically Alpine). I also tried with iPhones (for my family), and it also just works. I haven't tried using an Android device, is it what you are trying?

That might be the delta. I'm not using a hardware key (well, not a YubiKey). I'm using just my phone or browser.

Could it be that your phone is not compatible with passkeys? E.g. many Android phones don't have a TPM, isn't that a requirement for passkeys on Android?

As I said, it just works with iPhones and Yubikeys.

Re: Emailing a one-time code is worse than passwords

#787

Post by timmyc123 »

__MatrixMan__ wrote: post #771
timmyc123 wrote: post #757

Earlier quoted context omitted.

Just because an API or protocol has a certain capability, does not mean it is implemented for all use cases. Folks seem to be hung up on the term "attestation" being in the response of a create call. If you look inside that object, there is another carve out for optional authenticator attestation, which is not used for consumer use cases. I will keep repeating what I've said in the other comments. There is no credent…

OK, so suppose you and I were bad guys. You work on the code that interfaces with the TPM on a windows device, and I work at an insurance provider and write code that authenticates users. Suppose we hatch a conspiracy to take our users out of the "consumer synced passkey system". And into one where you can use the authentication ritual as a channel where you can pass me unique bits re: this user such that we can late…

I'd say:

1) That would be a whole lot of work, collusion, etc for a very limited scope and outcome, which makes it incredibly unlikely to happen in practice. 2) If a credential manager decides to do shady things that you don't like, you can change your credential manager. That's the beauty of an open ecosystem. 3) There are much easier ways to track users online...(unfortunately)

Re: Emailing a one-time code is worse than passwords

#788

Post by Friedduck »

I only have a couple of services that use this pattern and I’m cancelling them out of frustration.

If i use a personal email then I can’t access it on corporate machines and vice versa.

Theres so much friction in the process it’s not worth maintaining the service.

Re: Emailing a one-time code is worse than passwords

#789

Post by GoblinSlayer »

charcircuit wrote: post #621
drdaeman wrote: post #557

Earlier quoted context omitted.

You’re falling for the exact “better security” fallacy I was trying to warn about. Security is not a rating, “better security/guarantee” is not a really meaningful phrase on its own, even though it’s very tempting to take mental shortcuts and think in such terms. Attestation provides a guarantee that the credential is stored in a system controlled by a specific vendor. It’s not “more” or “less” secure, it’s just what…

>You’re falling for the exact “better security” fallacy How is it a fallacy? The rate of account compromises is a real metric that is affected by how good security there is for accounts.

It's just passwords from HIBP, you're not going to solve any other attack.

Re: Emailing a one-time code is worse than passwords

#790

Post by bsoles »

DecoPerson wrote: post #19

The attack pattern is: 1) User goes to BAD website and signs up. 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.” 3) BAD’s bots start a “Sign in with email one-time code” flow on the GOOD website using the user’s email. 4) GOOD sends a one-time login code email to the user’s email address. 5) The user is very likely to trust…

Aren't your passkeys stored with your password manager? As long as you have web access to your password manager, why would losing your phone be an issue? I am not a passkey users as I find them pretty confusing...
Post reply on HN