Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Emailing a one-time code is worse than passwords

blog.danielh.cc

Post reply on HN
Print view View original

791–800 of 816 posts

Re: Emailing a one-time code is worse than passwords

#791

Post by bccdee »

ihattendorf wrote: post #553
mvieira38 wrote: post #513

Earlier quoted context omitted.

Getting into your bitwarden account should be at least as hard as getting into your authenticator app or stealing your hardware key, though, if you're using it as intended, so I think it's ok for 2FA

2FA keys are easily stolen from a desktop with a password manager running in the background when running a malicious executable, vs. 2FA keys on a 2FA app on a phone and running a malicious app.

I don't know if this is true. A password manager should encrypt its data at rest, and exfiltrating a key from another process's memory space is non-trivial. At the very least, you'd need a privilege escalation trick.

Re: Emailing a one-time code is worse than passwords

#792

Post by MyNameIsFred »

abustamam wrote: post #483
t_mann wrote: post #65

Earlier quoted context omitted.

The problems of Passkeys are more nuanced than just losing access when a device is lost (which actually doesn't need to happen depending on your setup). The biggest problem are attestations, which let services block users who use tools that give them more freedom. Passkeys, or more generally challenge-response protocols, could easily have been an amazing replacement for passwords and a win-win for everyone. Unfortuna…

I want to like passkeys but I haven't had any success getting them to work. Every time I click on "sign in using passkey" both my browser (Firefox or Chrome, on Android/Win/Mac) and Bitwarden are like "no passkeys found" and I'm never given an option to create one. I feel like I'm doing something stupidly wrong or missing a prompt somewhere, or maybe UX is just shitty everywhere, but if I, a millennial who grew up pr…

I'm a personal and professional advocate from r passkeys, yet I must acknowledge that your criticisms and skepticism are valid. I don't see this as a flaw in the passkeys concept so much as a growing pain. It's a very different mental model, and I've seen businesses make some very poor implementation decisions based on some poor understanding of what this system aims to be. That in turn adds to a bad consumer impression, a growing body of bad examples for others to look to and replucate, and it all just compounds.

Re: Emailing a one-time code is worse than passwords

#793

Post by cnst »

dspillett wrote: post #284

And even if proper passwords are used, many sites/apps use this pattern for account recovery if the password is forgotten so effectively this is the only security as an attacker has “forgotten” the password and just uses this flow to login. I've got a little generic login tool that bits I write myself use for login, using this method, but it is not for anything sensitive or otherwise important (I just want to identif…

> And even if proper passwords are used, many sites/apps use this pattern for account recovery if the password is forgotten so effectively this is the only security as an attacker has “forgotten” the password and just uses this flow to login.

Why is NOONE talking about this? This is exactly why 2FA is less secure than password authentication, because with a password authentication, the attacker actually has to be able to capture the password in some way, whereas with 2FA, effectively anyone anywhere with the skills akin to the most junior private investigator, has the capability and tools to take over anyone's account "protected" by 2FA.

Yet we're still being told that 2FA is mandatory because security is important, and that somehow 2FA is still more secure.

Re: Emailing a one-time code is worse than passwords

#794

Post by fc417fc802 »

johncolanduoni wrote: post #775
63stack wrote: post #772

Earlier quoted context omitted.

Saying "oh that's enterprise" is just moving the goal posts. Chrome has already started kicking off extensions, see ublock. I can't divine the future about how they will further their income streams.

No it’s not. My goalpost from the beginning was “show me an example where there wasn’t a clear monetary incentive for restricting user freedom”. That one has a monetary incentive (make our paying customer for product X also buy product Y). As for blocking things that block ads; if you can’t see the monetary incentive for Google there then I don’t know what to tell you. I didn’t ask you to divine the future. I said “I…

You will almost always be able to find a way to derive a monetary advantage from any given arbitrary restriction of user freedom. Thus your claimed goalposts are essentially pointless.

Re: Emailing a one-time code is worse than passwords

#795

Post by anonymars »

timmyc123 wrote: post #756
vdqtp3 wrote: post #724

Earlier quoted context omitted.

Can you say "There will be no attestation in the consumer synced passkey ecosystem. Period."? That seems to be the concern, not what exists today.

Ecosystems are made up of hundreds of thousands of organizations, billions of devices,and billions of users. How do you expect a single person to be able to make an authoritative statement like that?

Well, you said definitively it's not in the...ecosystem, well of course it's not in that ecosystem now, but that's an extremely narrow reading of the question: the concern is it being in the spec that the consumer-facing ecosystem is pushing hard. A consumer-facing ecosystem that has amply demonstrated how much it loves lock-in. "Fool me once...can't get fooled again"

Re: Emailing a one-time code is worse than passwords

#796

Post by johncolanduoni »

fc417fc802 wrote: post #794
johncolanduoni wrote: post #775

Earlier quoted context omitted.

No it’s not. My goalpost from the beginning was “show me an example where there wasn’t a clear monetary incentive for restricting user freedom”. That one has a monetary incentive (make our paying customer for product X also buy product Y). As for blocking things that block ads; if you can’t see the monetary incentive for Google there then I don’t know what to tell you. I didn’t ask you to divine the future. I said “I…

You will almost always be able to find a way to derive a monetary advantage from any given arbitrary restriction of user freedom. Thus your claimed goalposts are essentially pointless.

Come on, I didn't come up with some 4D chess logic to impute a monetary advantage. In the examples people gave me, it was things like bundling (the oldest trick in the monopolist book) and ensuring that users look at your ads. Do you really think that if Chrome gets sued for blocking uBlock, that discovery won't find 1000 memos from executives and PMs at Google talking about how much money ensuring users have to see their ads would make?

Re: Emailing a one-time code is worse than passwords

#797

Post by valenterry »

palata wrote: post #785
valenterry wrote: post #758

Earlier quoted context omitted.

> but I don't know situations where a website works with some clients and not others For example: https://www.w3.org/TR/webauthn-2/#dictdef-authenticatorselec... > If the website accepts a password, then it can't prevent you from using the password manager you want. But if the website accepts FIDO2 passkeys, it's the same thing, isn't it? Unfortunately not...

> For example: [...] Those sound like requirements similar to those that can be enforced with passwords. My company enforces an SSO system with an MFA scheme that is controlled by the IT department. I can use my password manager for the password part, but I must use the mandatory MFA app. In that sense, I am not sure it is so different from passkeys?

Now you are not comparing passwords with passkeys anymore, but MFA with passkeys. Not sure what the point is in the context of the discussion.

> In that sense, I am not sure it is so different from passkeys?

Yes, if it means "company specific SSO* and a company chooses to force you to use the hardware they decided on, then that is in fact not very different from the passkey constraints.

Re: Emailing a one-time code is worse than passwords

#798

Post by esjeon »

anonymars wrote: post #460
esjeon wrote: post #306

The actual weak link here is not the procedure itself. It’s the fact that your email services will happily accept phishing mails into your inbox. I’m pretty sure we can prevent this by issuing some kind of proof of agreement (with sender and recipient info) thru email services. Joining a service becomes submitting a proof to the service, and any attempt to contact the user from the service side must be sealed with th…

The email is coming from the legitimate service, it's a man-in-the-middle attack. How does this scheme stop you from putting a legitimate code from a legitimate sender into an illegitimate website?

Ah, sorry, I did get that part, and my idea goes a little bit further, but somehow I thought I wrote enough.

One thing is that this problem occurs because we have two independent channels that we must independently verify. I’m pretty sure this is a whack-a-mole game, and will never be possible to fix.

Another thing is that, since we don’t trust emails, we hesitate sending links over email. However, the problem here is easy to avoid if services send login links directly to user, and those emails are automatically authenticated by the system.

Re: Emailing a one-time code is worse than passwords

#800

Post by ThunderSizzle »

rsanheim wrote: post #188

The worst part about this is it just further reinforces horrible habits and expectations. Using a modern password manager, like 1password, is _easier_, safer, and faster than the stupid email-token flow. it takes a little bit of work and attention at first to setup across a couple devices, and verify it works.... but its really about the same amount of effort as keeping track of a set of keys for your house, car, and…

> Using a modern password manager, like 1password, is _easier_, safer, and faster

LastPass got hacked a few years ago and the few passwords my wife had on it were pwned immediately. These cloud companies lost my trust after that.

I'd only trust offline password managers, eg KeePass. Never let me down yet.

Post reply on HN