Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Emailing a one-time code is worse than passwords

blog.danielh.cc

Post reply on HN
Print view View original

801–810 of 816 posts

Re: Emailing a one-time code is worse than passwords

#801

Post by fc417fc802 »

johncolanduoni wrote: post #796
fc417fc802 wrote: post #794

Earlier quoted context omitted.

You will almost always be able to find a way to derive a monetary advantage from any given arbitrary restriction of user freedom. Thus your claimed goalposts are essentially pointless.

Come on, I didn't come up with some 4D chess logic to impute a monetary advantage. In the examples people gave me, it was things like bundling (the oldest trick in the monopolist book) and ensuring that users look at your ads. Do you really think that if Chrome gets sued for blocking uBlock, that discovery won't find 1000 memos from executives and PMs at Google talking about how much money ensuring users have to see…

Fair point, it's less immediately obvious. Still I don't see where 4D chess is necessary. Some levers let you make money directly. The effective use of others is more opaque but if you hoard enough of them you will presumably be able to figure something out.

Where's the direct monetary incentive to interfere with end users installing a modified Android image? What about SafetyNet?

At absolute minimum you can use it to influence the perception of your brand as being the gold standard.

Re: Emailing a one-time code is worse than passwords

#802

Post by biinjo »

sbrother wrote: post #562
abustamam wrote: post #483

Earlier quoted context omitted.

I want to like passkeys but I haven't had any success getting them to work. Every time I click on "sign in using passkey" both my browser (Firefox or Chrome, on Android/Win/Mac) and Bitwarden are like "no passkeys found" and I'm never given an option to create one. I feel like I'm doing something stupidly wrong or missing a prompt somewhere, or maybe UX is just shitty everywhere, but if I, a millennial who grew up pr…

I'm in the same boat. I just cannot get them to work; they work sometimes on some browsers , but a solid majority of the time I click on "use passkey" I get a generic error message and end up going back and using the password flow. I haven't invested more time in this because if it's so unusable for me as an engineer, it's a non-starter for the general public.

And then there is Sony Playstation network. Set a passkey on your account when you’re on a computer browsing their store or managing your account.

Go to the playstation. Can’t login anymore. Passkey not supported.

Re: Emailing a one-time code is worse than passwords

#803

Post by 63stack »

johncolanduoni wrote: post #796
fc417fc802 wrote: post #794

Earlier quoted context omitted.

You will almost always be able to find a way to derive a monetary advantage from any given arbitrary restriction of user freedom. Thus your claimed goalposts are essentially pointless.

Come on, I didn't come up with some 4D chess logic to impute a monetary advantage. In the examples people gave me, it was things like bundling (the oldest trick in the monopolist book) and ensuring that users look at your ads. Do you really think that if Chrome gets sued for blocking uBlock, that discovery won't find 1000 memos from executives and PMs at Google talking about how much money ensuring users have to see…

Respectfully, you don't seem to understand the full picture on this.

Re: Emailing a one-time code is worse than passwords

#804

Post by ThunderSizzle »

0xfeba wrote: post #495
dspillett wrote: post #284

And even if proper passwords are used, many sites/apps use this pattern for account recovery if the password is forgotten so effectively this is the only security as an attacker has “forgotten” the password and just uses this flow to login. I've got a little generic login tool that bits I write myself use for login, using this method, but it is not for anything sensitive or otherwise important (I just want to identif…

> And even if proper passwords are used, many sites/apps use this pattern for account recovery if the password is forgotten so effectively this is the only security as an attacker has “forgotten” the password and just uses this flow to login. Was about to post just this. This is the flow they use for account recovery so it's the weakest link in the chain anyway.

Well, no. I'm more attention to what I'm doing if I have to recover my account. My typical login is something I have to do every day for every place, so it's easy to become more careless subconsciously.

Since this is about the human accidentally getting tricked to give a code to a malicious actor, I do think that workflow abuses humans being overtired by too many factors of auth by too many different services. I just want to login and get my thing done, but now I have to spend time waiting on email, etc.

Re: Emailing a one-time code is worse than passwords

#805

Post by soiltype »

KingOfCoders wrote: post #728
soiltype wrote: post #494

Earlier quoted context omitted.

unless the product manager decided the link in the email is track.monkey.exe/sus/path/spyware?c=behhdywbsncocjdb&b=ndbejsudndbd&k=uehwbehsysjendbdhjdodj or something 2x–3x longer

The question was "How do you know the email comes from that website? " And the answer was, I can find out if the email is from abc.com by looking at the link, which should also be abc.com I don't click in "track.monkey.exe". I don't click tracking links. I pay a lot of money for my newsletter provider because I can turn off (most) tracking links.

The question was framed that way but in fact this conversation isn't about your personal resistance to a particular scam vector.

Many sites do offload 100% of their emailing to 3rd party trackers. Therefore nobody can use those sites without engaging in 3rd party tracking. Therefore these sites have created an environment favorable for this scam vector.

Re: Emailing a one-time code is worse than passwords

#806

Post by mangodrunk »

const_cast wrote: post #413
codedokode wrote: post #373

Earlier quoted context omitted.

Password managers are those proprietary programs that you need to install, give full access to your computer, register an account and trust their word that your passwords are uploaded to the cloud securely? No thanks. Also they are too complicated for an ordinary user. A physical key is much simpler and doesn't require any setup or thinking, and can be used on multiple devices without any configuration. And doesn't r…

Password managers are both significantly simpler to use than just passwords and more secure. Passwords have always been bad. The problem is that users can't remember them. So they rotate, like, 3 passwords. Which means if fuckyou.com is breached then your bank account will be drained. Great. On top of that, the three passwords they choose are usually super easy to guess or brute force. With a password manager, users…

And if the password manager is compromised, then again everything is lost. I doubt people are indeed using good passwords for it, and does this assume you only use one device that you will always use?

Re: Emailing a one-time code is worse than passwords

#807

Post by mangodrunk »

Hackbraten wrote: post #436
blkhawk wrote: post #389

Earlier quoted context omitted.

uh no - a password manager is an open source application you can compile and install yourself if you want. Its nothing more than a small specialised database with a excel like interface. Personally I think that the argument that things are "too complicated for the average user" eventually gets gets you users that find breathing and sphincter function too complicated.

I’ve been observing this space for two decades and haven’t come across a single open-source password manager that actually works, is properly maintained, has an acceptable security track record, and comes with a similarly well-maintained browser extension that protects both my clipboard and myself from phishing.

It’s annoying how people are gaslighting you into thinking this is a solved problem. As if password managers don’t have issues themselves and even if they did solve that aspect, it’s only a part of the whole problem.

Re: Emailing a one-time code is worse than passwords

#808

Post by const_cast »

mangodrunk wrote: post #806
const_cast wrote: post #413

Earlier quoted context omitted.

Password managers are both significantly simpler to use than just passwords and more secure. Passwords have always been bad. The problem is that users can't remember them. So they rotate, like, 3 passwords. Which means if fuckyou.com is breached then your bank account will be drained. Great. On top of that, the three passwords they choose are usually super easy to guess or brute force. With a password manager, users…

And if the password manager is compromised, then again everything is lost. I doubt people are indeed using good passwords for it, and does this assume you only use one device that you will always use?

> I doubt people are indeed using good passwords for it

I don't, but even if I do, the simple fact remains that remembering one password is easier than 300.

If you have to remember 300 passwords, youre gonna choose 'password1' - 'password300'. Because we're not living hashmaps.

But with one password, I can easily make it even 40 characters and remember it. And anybody can do that.

If you DON'T use a password manager, you don't solve the problem of "everything is lost". Because people just reuse passwords as noted above.

So Experian gets breached, which is WAYYYYY more likely than your encrypted password manager getting breached, and now your bank is also open, and your Gmail, and your IRS.gov. whoops.

> does this assume you only use one device that you will always use

No, password managers work on all your devices and auto sync. How is it done so securely and without any hiccups? Because they're super simple pieces of software.

You just take the passwords, derive a key from the master password, and encrypt all the passwords. Then dump it in whatever online storage.

I could write a password manager in a couple hours.

Re: Emailing a one-time code is worse than passwords

#809

Post by abustamam »

palata wrote: post #786
abustamam wrote: post #727

Earlier quoted context omitted.

That might be the delta. I'm not using a hardware key (well, not a YubiKey). I'm using just my phone or browser.

Could it be that your phone is not compatible with passkeys? E.g. many Android phones don't have a TPM, isn't that a requirement for passkeys on Android? As I said, it just works with iPhones and Yubikeys.

Oddly, passkeys work on my phone on the Nintendo site, of all places. I can't seem to get it to work on Github. So it does work, just not everywhere.

Re: Emailing a one-time code is worse than passwords

#810

Post by anonymars »

esjeon wrote: post #798
anonymars wrote: post #460

Earlier quoted context omitted.

The email is coming from the legitimate service, it's a man-in-the-middle attack. How does this scheme stop you from putting a legitimate code from a legitimate sender into an illegitimate website?

Ah, sorry, I did get that part, and my idea goes a little bit further, but somehow I thought I wrote enough. One thing is that this problem occurs because we have two independent channels that we must independently verify. I’m pretty sure this is a whack-a-mole game, and will never be possible to fix. Another thing is that, since we don’t trust emails, we hesitate sending links over email. However, the problem here i…

But I think with email login links you have one of several problems:

1. How do you know the email is for a session you actually initiated? In the extreme case, imagine maliciously triggering a login a link for 100,000 users. How many will click the link and get their account taken over? I bet it's nonzero (what's the minimum net you must cast to get access to one account?)

2. Or, what about various software that automatically previews links? A GET request is not secure for this purpose

3. But if you are instead suggesting a link takes you to an authenticated session (rather than authenticating an arbitrary session) now you have the problem that you must log into your email on the device from which you wish to access the account

Post reply on HN