Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Emailing a one-time code is worse than passwords

blog.danielh.cc

Post reply on HN
Print view View original

811–816 of 816 posts

Re: Emailing a one-time code is worse than passwords

#811

Post by raxxorraxor »

jrockway wrote: post #408
technion wrote: post #250

Earlier quoted context omitted.

I would counter argue being the person pushing passkeys in an enterprise: noone in the business knows what attestation is, but we're going to do it because the interface recommends it.

I'm not sure it's the standards committee's fault that your employer hires people that don't know how to do their job. I think it's reasonable to have attestation for the corporate use case. If they're buying security devices from a certain vendor, it's reasonable for their server to check that the person pretending to be you at the other end is using one of those devices. It's an extra bit of confidence that you're…

The most common fault of committees is that they overengineer processes and specs wander out of scope. The result is that users (dev & consumers) either neglect the bad parts or the spec doesn't get used at all.

Re: Emailing a one-time code is worse than passwords

#814

Post by maronato »

abustamam wrote: post #483
t_mann wrote: post #65

Earlier quoted context omitted.

The problems of Passkeys are more nuanced than just losing access when a device is lost (which actually doesn't need to happen depending on your setup). The biggest problem are attestations, which let services block users who use tools that give them more freedom. Passkeys, or more generally challenge-response protocols, could easily have been an amazing replacement for passwords and a win-win for everyone. Unfortuna…

I want to like passkeys but I haven't had any success getting them to work. Every time I click on "sign in using passkey" both my browser (Firefox or Chrome, on Android/Win/Mac) and Bitwarden are like "no passkeys found" and I'm never given an option to create one. I feel like I'm doing something stupidly wrong or missing a prompt somewhere, or maybe UX is just shitty everywhere, but if I, a millennial who grew up pr…

Most websites don’t let users sign up with passkeys. You need to create an account using email/password and then go to their settings page and create a passkey. Now you can sign in with the passkey.

Re: Emailing a one-time code is worse than passwords

#815

Post by geocar »

account42 wrote: post #299
geocar wrote: post #152

Earlier quoted context omitted.

> The attack pattern is: There are lots of attack patterns. That is one. I am not certain I believe it is very likely, because (a) I think "sign-in partner" is obvious bullshit, and (b) I don't understand why I would never enter a code into the wrong website. I believe it can be possible, but... > Passkeys is the way to go. ... I’d rather granny needs to visit the bank to get access to her account again, than someone…

> I am not certain I believe it is very likely, because (a) I think "sign-in partner" is obvious bullshit It's looks almost the same as the log-in-with-big-tech flow that users are already used to. > and (b) I don't understand why I would never enter a code into the wrong website. I believe it can be possible, but... You enter it on the website you are trying to log into and where you initiated the action, which in t…

None of this convinces me the fantasy-scenario is likely, nor that passkeys would do anything to solve it: If the sign-in partner sends login-codes via email that it accepts via proxy servers, they're definitely not going to implement passkeys.

Re: Emailing a one-time code is worse than passwords

#816

Post by linhan_dot_dev »

DecoPerson wrote: post #19

The attack pattern is: 1) User goes to BAD website and signs up. 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.” 3) BAD’s bots start a “Sign in with email one-time code” flow on the GOOD website using the user’s email. 4) GOOD sends a one-time login code email to the user’s email address. 5) The user is very likely to trust…

The scene you described helped me quickly grasp the whole situation! I'd like to add a new example. In your example, the most dangerous part is "the user being convinced to visit the BAD website." Here's my example:

- The scammer initiates a login attempt.

- The user receives a text message with a 6-digit code and might get confused.

- The user receives a phone call from the fraudster.

- The fraudster pretends to be a representative from the software platform, convincing the user there's an issue.

- At this point, another fake text message is sent, with a link to a convincing-looking platform.

- The user enters the 6-digit verification code they just saw on this fake platform.

- The scammer logs in successfully.

Post reply on HN