20 ms·
Emailing a one-time code is worse than passwords
- charlesabarnes 1y agoWholeheartedly agree, however The Changelog Podcast helped shift my perspective on this. It's really about not having the responsibility of storing and maintaining passwords.
- augunrik 1y agoKinda weird when they secure shop sites where you enter your payment information into. IKEA does this, for example.
- AndroTux 1y agoYou should never store passwords anyways. You store hashes. I don’t see the issue. If you don’t trust yourself to keep a hash, maybe don’t store user information at all.
- benrutter 1y agoThat's still not perfect though! Most leaked passwords online come initially from leaked hashes, which bad actors use tools like hashcat to crack. If your user has a password like "password123" and the hash gets out, then the password is effectively out too, since people can easily lookup the hash of previous cracked passwords like "password123".
- csnover 1y agoNo. This is why salts[0] are used. [0] https://en.wikipedia.org/wiki/Salt_(cryptography) https://en.wikipedia.org/wiki/Salt_(cryptography)
- incorrecthorse 1y agoAnd compute-intensive hash functions. Computers this day are powerful enough to hashcat each individual pwd+salt if a fast hashing function is used.
- integralid 1y agoThis is how it should be done. But it still doesn't protect users fully, because attacker can try to brute-force passwords their interested in. It requires much more effort though.
- Macha 1y agoSalting already fixed this decades ago, and most modern password libraries will automatically generate and verify against a hash like <method>$salt$saltedhash if you use them instead of rolling your own.
- internetter 1y agoI feel like this is going to bite me in the ass 15 years from now but like bcrypt is really really hard to screw up
- FabHK 1y agoLatacora, 2018: In order of preference, use scrypt, argon2, bcrypt, and then if nothing else is available PBKDF2. So even 7 years ago bcrypt was only the 3rd recommended option.
- LVB 1y agoThey follow with: "But, seriously: you can throw a dart at a wall to pick one of these... In practice, it mostly matters that you use a real secure password hash, and not as much which one you use.
- internetter 1y agoYou'll find that opinion is still divided among these three options. And bcrypt is harder to mess up. It has less parameters (it doesn't fall apart as easy) and salting is built in, whereas its not for scrypt and argon2. If, knowing nothing else about the competency of the programmer, I had to choose between an application using scrypt, argon2 and bcrypt, I'd pick bcrypt any day.
- daemin 1y agoSo if they don't want to store your passwords because they do not want the responsibility of keeping it safe, should you trust your credit card and other personal information with them?
- adastra22 1y agoSo? They don’t want to store my password, so instead they immensely weaken the security of my account? This is not good for the user.
- malfist 1y agoWhole heartedly agree. It's not more secure if you only use the second factor of two factor auth.
- LoganDark 1y agoCodes that are provided on demand by a service will always be far less secure than proper TOTP. Because in the case of proper TOTP, no secret ever leaves the service after initial configuration, but in the case of discount 2FA through email or especially SMS, a fresh secret has to be delivered to me each time, where it can easily be intercepted by all manner of attacks.
- malfist 1y agoAbsolutely, a shocking about if email traffic is still unencrypted. Any hop along the SMTP way could be compromised
- hooverd 1y agoI thought this was going to be about Passkeys. Maybe if the FIDO Alliance can stop being obstinant and allow real backups, I'd be all in on them.
- jjani 1y agoEven with backups, the attestation issue makes them awful.
- anonymars 1y agoI'm not familiar with this issue and a quick search didn't turn up anything obvious. Would you mind elaborating?
- Arrowmaster 1y agoThey are referring to the ability of a site you are logging into forcing you to use a client from a specific list or having a list of clients to deny. It's copied over from FIDO hardware keys where each device type needed to be identifiable so higher tier ones could be required or unsecured development versions could be blocked.
- jjani 1y agoThis is what I was referring to, and we already have seen this happen in the wild with PayPal at one point (possibly still) blocking passkeys from e.g. Firefox. For now the argument against this seems to be that "Apple zeroes this out so service providers can't do it without risking issues for their many users who use Apple to store their keys", but clearly this is so precarious of a situation it may as well not be a thing. You can't depend on one trillion-dollar company not changing their minds on that tomorrow.
- reginald78 1y agoEven with the current flimsy "What about iPhones?" defense against attestation, is there anything stopping say Microsoft from just forcing you to install a different app to use Microsoft services?
- ripped_britches 1y agoThey aren’t ideal but are they actually worse than passwords? I’d bet that on net, more compromises happen with previously-leaked passwords
- deathanatos 1y agoI haven't actually seen these being used as passwords like TFA states; they're usually a form of 2FA. If they actually are passwords, yes, my password manager is a better UX than having to fetch my phone, open SMS, wait for the SMS, like good grief it's all so slow. (In the 2FA form, I'd prefer TOTP over SMS-OTP, but the difference is less there.)
- totallykvothe 1y agoI'm having difficulty understanding what it means for an attacker to "send your email to a legitimate service"...
- deleted 1y ago[deleted]
- anonymars 1y agoI assume it's a phishing scenario, given the note about password managers. Evil site spoofs the login page, and when you attempt to log in to the malicious site, it triggers an attempt from the real site, which will duly pass you a code, which you unwittingly put into the malicious site
- LoganDark 1y agoTOTP is vulnerable to the same attack, though. If you are fooled into providing the code, it doesn't matter whether it's a fresh one to your email or a fresh one from your authenticator.
- eddythompson80 1y agoThey are, which is one major issue with TOTP and most current MFA methods. There is an implicit assumption that you only get the full benefit if your usi g a password manager. 1. A password manager shouldn't be vulnerable to putting your password in a phishing site. 2. If your password is leaked, an attacker can't use it without the TOTP. Someone who doesn't use a password manager won't get the benefits of #1, so they can be phished even with a TOTP. But they will get the benefits of #2 (a leaked password isn't enough) Passkeys assume/require the use of a password manager (called a "passkey provider")
- LoganDark 1y agoPasskeys do largely solve this issue. I love to use them whenever I can.
- 1y ago
- wodenokoto 1y agoLot's of services realized that users would use the reset password form for login.
- 6510 1y agoTo state the obvious, there the code is part of the url they have to visit.
- DecoPerson 1y agoThe attack pattern is: 1) User goes to BAD website and signs up. 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.” 3) BAD’s bots start a “Sign in with email one-time code” flow on the GOOD website using the user’s email. 4) GOOD sends a one-time login code email to the user’s email address. 5) The user is very likely to trust this email, because it’s from GOOD, and why would GOOD send it if it’s not a proper login? 6) User enters code into BAD’s website. 7) BAD uses code to login to GOOD’s website as the user. BAD now has full access to the user’s GOOD account. This is why “email me a one-time code” is one of the worst authentication flows for phishing. It’s just so hard to stop users from making this mistake. “Click a link in the email” is a tiny bit better because it takes the user straight to the GOOD website, and passing that link to BAD is more tedious and therefore more suspicious. However, if some popular email service suddenly decides your login emails or the login link within should be blocked, then suddenly many of your users cannot login. Passkeys is the way to go. Password manager support for passkeys is getting really good. And I assure you, all passkeys being lost when a user loses their phone is far, far better than what’s been happening with passwords. I’d rather granny needs to visit the bank to get access to her account again, than someone phishes her and steals all her money.
- pandorobo 1y agoVery short, badly written article. It can't even describe phishing correctly... At least label your threat model correctly. While the premise is correct -- it's easy to complain but the author also provides zero recommendations on what is a better form of MFA.
- ipython 1y agoThe first factor is access to your email. The second factor is…?
- max__dev 1y agoThe article is not about MFA. It is about using email as a single factor.
- pandorobo 1y agoThats simple a lie or you didn't read the article. The very first bullet point states: Enter an email address or phone number That insinuates email OR SMS. It doesn't just mention email only.
- sophiebits 1y agoHalf factor authentication, then, since either one will work.
- max__dev 1y agoThe following is copied from wikipedia. The authentication factors of a multi-factor authentication scheme may include: 1. Something the user has: Any physical object in the possession of the user, such as a security token (USB stick), a bank card, a key, a phone that can be reached at a certain number, etc. 2. Something the user knows: Certain knowledge only known to the user, such as a password, PIN, PUK, etc. 3. Something the user is: Some physical characteristic of the user (biometrics), such as a fingerprint, eye iris, voice, typing speed, pattern in key press intervals, etc. Email and phone are both in category one, comprising only one unique factor.
- 1y ago
- giantfrog 1y agoStill seems far, far more likely that the average user will have their account stolen via password theft/reuse than the more complicated scheme the author is describing. Links instead of codes also fixes the issue.
- 6510 1y agoMS can also call you, then you only have to press # to log in. Makes it even easier for a spoof website.
- yieldcrv 1y agoI like passkeys on the Apple ecosystem
- forkeep 1y ago[dead]
- moomoo11 1y agoPasswordless is fine. Let’s be honest all forms of auth suck and have pros and cons. The real solution is detect weird logins because users cannot be trusted. That’s why we build for them!
- ameliaquining 1y agoSo there are two complaints about this authn scheme that I'm seeing in this thread: 1. It's pretty phishable. I think this is mostly solved, or at least greatly mitigated, by using a Slack-style magic sign-in link instead of a code that you have the user manually enter into the trusted UI. A phisher would have to get the user to copy-paste the URL from the email into their UI, instead of clicking the link or copy-pasting it into the address bar. That's an unusual enough action that most users probably won't default to doing it (and you could improve this by not showing the URL in HTML email, instead having users click an image, but that might cause usability problems). It's not quite fully unphishable, but it seems about as close as you can get without completely hiding the authentication secret from the user, which is what passkeys, Yubikeys, etc., do. I'd love to see the future where passkeys are the only way to log into most websites, but I think websites are reluctant to go there as long as the ecosystem is relatively immature. 2. It's not true multi-factor authn because an attacker only needs to compromise one thing (your inbox) to hijack your account. I have two objections to this argument: a. This is already the case as long as you have an email-based password reset flow, which most consumer-facing websites are unwilling to go without. (Password reset emails are a bit less vulnerable to phishing because a user who didn't request one is more likely to be suspicious when one shows up in their inbox, but see point 1.) b. True multi-factor authn for ordinary consumer websites never really worked, and especially doesn't work in the age of password managers. As long as those exist, anyone who possesses and is logged into the user's phone or laptop (the usual prerequisites for a possession-based second factor) can also get their password. Most websites should not be in the business of trying to use knowledge-based authentication on their users, because they can't know whether the secret really came from the user's memory or was instead stored somewhere, the latter case is far more common in practice, and only in the former case is it truly knowledge-based. Websites should instead authenticate only the device, and delegate to the device's own authentication system (which includes physical possession and likely also a lock secret and/or biometric) the task of authenticating the user in a secure multi-factor way.
- ajanuary 1y agoTwo problems I’ve encountered with magic links: * Mobile email clients that open links in an embedded browser. This confuses some people. From their perspective they never stay logged in, because every time they open their regular browser they don’t have a session (because it was created in the embedded browser) and have to request a login link again. * Some people don’t have their email on the device they want to log in on. Sending codes solves both of these problems (but then has the issues described in the article, and both share all the problems with sending emails)
- f4c39012 1y agoSome sites make this into a problem accessing their site by having an unsubscribe that doesn't account for this login method. Unsubscribing from marketing means I can no longer login
- mnw21cam 1y agoWow, that's some joined-up thinking.
- eviks 1y agoIndeed, such a bad design where instead of a simple and quick 1-shortcut login from a fishing-resistant password manager users have to waste time switching back and forth between different apps/devices
- clement_b 1y agoWhat's quite annoying is how agressive most products are into forcing this method over regular email+pw / Social Logins. Let me use my 100 chars password!
- whyever 1y agoSuch long passwords are silly, they will be effectively truncated by the key length of the underlying cryptography.
- sweetjuly 1y agoPasswords are (or, rather, SHOULD be) cryptographically hashed rather than encrypted. It's possible to compute a hash over data which is longer than the hash input block size by feeding precious hashes and the next input block back in to progressively build up a hash of the entire data.
- xx_ns 1y agobcrypt, one of the more popular password hashing algorithms out there, allows the password to be up to 72 characters in length. Any characters beyond that 72 limit are ignored and the password is silently truncated (!!!). It's actually a good method of testing whether a site uses bcrypt or not. If you set a password longer than 72 characters, but can sign in using just the 72 characters of your password, they're in all likelihood using bcrypt.
- deleted 1y ago[deleted]
- integralid 1y agoYeah, that's why bcrypt is broken and shouldn't be used today. It had a good run, but nowadays we have better options like scrypt or argon2.
- daneel_w 1y ago
- rcarmo 1y agoAnthropic/Claude does this and it is a shame. They have the ability to code proper Authenticator and yet don’t.
- yuyu741 1y ago[dead]
- mahirsaid 1y agoThis has been driving me nuts. Ever since implementation. This method has been the biggest disappointment of login procedures and quickness. I dont want to go through, three to five steps just to login and in the meantime I forget what I came to the service for in the first place. There's gotta be a better method for security and streamlining sign in's. I should not have to do the work of security for the service and every other week I hear about the same service being hacked and millions of accounts are now affected.
- iEchoic 1y agoFour times a day, I get an email notification that someone requested a password reset for my Microsoft account, which gives me a six-digit number to recover my account. So every day, an attacker has four shots in 1,000,000 of stealing my account by just guessing the number. They've been doing this for years. If the attacker's doing this to thousands of accounts - which I'm sure they are - they're going to be stealing accounts for free just by guessing. I wrote up a security report and submitted it and they said that I hadn't sufficiently mathematically demonstrated that this is a security vulnerability. So your only option is to get spammed and hope your account doesn't get stolen, I guess.
- w3ll_w3ll_w3ll 1y agoOr you could enable MFA?
- Lukas_Skywalker 1y agoI have added what I think they call login alias to my account. This blocks logins using the normal account username (which is my public email address), and only allows them via the alias (which is not public and just a random string). Not a single foreign login attempt since I enabled the alias. You can enable it on account.microsoft.com > Account Info > Sign-in preferences > Add email > Add Alias and make it primary. Then click Change Sign-in Preferences, and only enable the alias.
- nomercy400 1y agoI had to do this as well. My account got spammed daily in such a way I had to verify my account and change my password on every login. With the alias I no longer have this issue.
- Hnrobert42 1y agoThen, is the login alias sort of a password? In that, it is something you know.
- Lukas_Skywalker 1y ago
- kazinator 1y agoI believe (and the article should make it clear) that the article is criticizing specifically the use of the code that user must enter into a box, which invites man-in-the-middle attacks. The article is not advocating against e-mail-driven URL-based password reset/login, whereby the user doesn't enter any code, but must follow a URL. The six digit code can be typed into a phony box put up by a malicious web site or application, which has inserted itself between the user and the legitimate site. The malicious site presents phony UI promoting the user to initiate a coded login. Behind the scenes, the malicious site does that by contacting the genuine site, and provoking a coded login. The user goes to their inbox and copies the code to the malicious site's UI. The site then uses it to obtain a session with the genuine site, taking over the user's account. A SSL protected URL cannot be so easily intercepted. The user clicks on it and it goes to the domain of the genuine site.
- bibelo 1y agoI'm technical and I didn't understand this article.
- doe88 1y agoSome days when I'm tired of receiving a new authentication code, I'm half-jokingly thinking : we're certainly must reaching a point where at least half of all SMS messages sent are authentication codes (with a small payload, for now).
- OtomotO 1y agoAll the talk about passkeys boils down to: A passphrase is basically like a password in the sense that I can lose it, but it's not like a password in the sense that I can actually memorise it. (Or rather, all of them) I prefer my passwordstore workflow. I remember two passwords, the rest is kept save for me and unlocked when I need them. It's not perfect, but it's by far the least worse solution of them all.
- deleted 1y ago[deleted]
- ManlyBread 1y ago[flagged]
- procaryote 1y agoIt's correct and to the point. What are you missing?
- ManlyBread 1y agoThe author couldn't even be bothered to write about the supposed examples of these practices being wrong. The whole thing lacks detail and actual arguments, instead we get "please stop" like it's some sort of a reddit or twitter shitpost. Look at this - https://news.ycombinator.com/item?id=44822267 https://news.ycombinator.com/item?id=44822267 - is this what this site is supposed to be now? Writing the article in the place of the author because the author couldn't be bothered to even form their own argument correctly? What the fuck? The fact that this has been upvoted so high and allowed to stay on the front page is also a clear signal to others that this low-effort garbage is welcome here, which will only encourage others to post similarly worthless blogposts, lowering the overall quality of this site. There are multiple comments in this very thread that are longer than this "article". My own comment is longer!
- alt227 1y agoIs this what this site is supposed to be now? People ranting, complaining, and swearing about how a post submission is not what they think should be on the site? The post spawned an interesting conversation, thats worth itself alone. Go put replies like this on reddit where they belong.
- ManlyBread 1y agoInteresting conversations can also happen under articles that have actual substance, there's no need to tolerate such short blogposts just because these might spawn an interesting discussion. Funny that you mention reddit because this is the exact same type of spam that pollutes /r/programming.
- allears62 1y agoMy main frustration with this sort of system, beyond the security risks is the terrible UX of a system like Spotify. I appreciate most people log in and stay logged in but I frequently switch Spotify accounts and I use passwords to log in, instead of letting me choose password or a 6 digit code, every time I try and change account a needless 6 digit code is generated and sent to a shared inbox, a huge waste of resources and storage. In addition to being a security concern as flagged throughout this thread.
- pas 1y agoSpotify has terrible UX in general. You can't even copy the fucking track title. Try multi-account containers so no need to log out? (Or Island on Android?)
- gregorvand 1y agoServices love it because it hands off the risk and responsibility to… Google/Gmail in most personal cases. This was why the pattern was adopted so quickly.
- rsanheim 1y agoThe worst part about this is it just further reinforces horrible habits and expectations. Using a modern password manager, like 1password, is _easier_, safer, and faster than the stupid email-token flow. it takes a little bit of work and attention at first to setup across a couple devices, and verify it works.... but its really about the same amount of effort as keeping track of a set of keys for your house, car, and maybe a workplace. If you make a copy of a door key when you move into a new place, you test the key before assuming it works. Same thing with a password manager. Save a password on your phone, test it on a different device, and verify the magic sync works. Same as a key copier or some new locks a locksmith may install. Humans can do this. You don't need to understand crypto or 2fa, but you can click 'create new password' and let the app save some insanely secure password for a new site. Same with a passkey, assuming you don't save to your builtin device storage that has some horrible, hidden user interface around backing that up for when your phone dies. And the irony is the old flow just works better! You let the password manager do the autofill, and it takes a second or two, assuming their is an email _and_ a password input. Passkeys can be even faster.
- vpribish 1y agothat little bit of work and attention is too much for most people. I'm as frustrated about this as you are, but there is a large class of people who will not or can not understand and implement the password-manager workflow. Of the people I know who are not in a tech career i'd say about 80% have nothing but contempt and ignorant fatalism toward security. The only success I've had is getting one older relative to start writing account credentials down in a little paper notebook and making sure there are numbers and letters in the passwords.
- ThunderSizzle 1y ago> Using a modern password manager, like 1password, is _easier_, safer, and faster LastPass got hacked a few years ago and the few passwords my wife had on it were pwned immediately. These cloud companies lost my trust after that. I'd only trust offline password managers, eg KeePass. Never let me down yet.
- FabHK 1y agoOne additional annoyance with this type of login: With a username and password field, these are automatically correctly filled by Safari. With sites that only offer an email field, I have to manually fill it. (Note that I tend to use different emails for different sites; if you only ever use one email this might not be a problem).
- Angostura 1y agoI read this sentence 4 times and I still can't parse it: > An attacker can simply send your email address to a legitimate service, and prompt for a 6-digit code. You can't know for sure if the code is supposed to be entered in the right place.
- antirez 1y agoBecause the sentence makes no sense, but what the author wanted to say was: - You are in front of the attacker site that looks like a legitimate site where you have an account (you arrived there in any way: Whatsapp link, SMS, email, whatever). Probably the address bar of your browser shows something like microsoft.minecraft-softwareupdate.com or something alike, but the random user can't tell it's fake. The page asks you to login (in order to steal your account). - You enter the email address to login. They enter your email address in the legitimate site where you actually have an account. - Legitimate site (for example Microsoft) sends you an email with a six digit code, you read the code, it looks legit (it is legit) and you enter it in the attacker site. They can now login with your account.
- trinix912 1y agoI think one can also understand it as the attacker being the one to enter the email first. > An attacker can simply send your email address to a legitimate service, and prompt for a 6-digit code. You can't know for sure if the code is supposed to be entered in the right place. Replace "can simply send your email address" with "can simply input your email address". An attacked inputs your email at login.example.com, which sends a code to your email. The attacker then prompts you for that code (ex. via a phishing sms), so you pass them the code that lets them into the account.
- kenjackson 1y agoI read it as just some web page that was bad, but not necessarily imitating a good sits. For example some new gaming forum that pops up, which is bad, but uses the gaming forum to get people to send them six digit codes which they use for whatever sites they see fit. Then the people who run the gaming forum are now stealing your Etsy account.
- wkat4242 1y agoIt's also a lot less convenient. Because I need to have access to my email, wait for the code, copy it etc. I hate companies that dump this extra work on me, like booking.com and all the AI companies. Passkeys would be so much easier, convenient and so much more secure. I really don't understand why they go for this.
- deleted 1y ago[deleted]
- StillBored 1y agoAnd there is _NOTHING_ worse than being locked out of an account because without asking they reverse the password and second factor authentication while your traveling and don't have access to a phone/etc. Nevermind. that pretty much all services treat the second factor as more secure than my 20 character random password saved in a local password safe. And those second factors are, lets see, plain text over SMS, plain text over the internet to an email address, etc, etc, etc.
- dabeeeenster 1y agoWhat percentage of people reuse the same password as opposed to use a password manager?
- BrenBarn 1y agoI would say it is very high. In my experience password managers are rarely used by nontechnical people.
- bigbacaloa 1y ago[dead]
- AtNightWeCode 1y agoI would have agreed to this if it weren’t for the fact that, for various reasons, you occasionally need to copy and paste passwords manually from password managers. This phishing scenario is no worse.
- torium 1y agoYou're gonna have to take my passwords from my cold dead hands.
- Nevor 1y agoThere are some short comings about using email codes but I fail to see how this worse than passwords when the same exact kind of attack would work for passwords. The difference being that it would be worse with passwords which can be stored, reused later or sometimes changed directly on the service.
- hendry 1y agoI came to the comments to say this. Nevor and I are one.
- kevincox 1y agoMy password manager will never fill my password into the wrong site. I would need to do so manually which sets of so many alarm bells in my head. With email pasting the number into a random website is the expected flow and there is basically no protection (some phones have basic protections for SMS auth but even this only works if you are signing in on the same device).
- angrydev 1y agoOP is just ragebait for nerds. How many articles have been published in the last 20 years about the issues with passwords? Now we're saying that the small chance some user ends up on bad-minecraft.com with a login form is actually worse than using "L3tmein!" as a password everywhere? Please find something more worthy to spend your time thinking about.
- noduerme 1y agoI've conscientiously ignored every attempt by every service in the past decade to bully me into giving up a phone number for 2FA. Authenicator apps and passkeys, fine. But never over SMS.
- arccy 1y agoSMS isn't just insecure, it's a pain when you're out of the country.
- grahameb 1y agoI recently set up passkey-only sign ins for a webapp I'm writing using Authentik [0](Python OIDC provider, with quite a nice docker-compose run-up, took only minutes to stand up.) It was surprisingly easy to configure everything so that passkeys are the only thing ever used. If anyone would be interested I could write it up? I was surprised what a nice user flow it is and how easy it was to achieve. [0] https://goauthentik.io/ https://goauthentik.io/
- yafujifide 1y agoThere is a way to fix this. Don't just require a 6 digit code. Require a 6 digit code and a long random string (an expiring token), which is only present on the page the user visited, or in the email they were sent.
- amelius 1y agoAlso the 6-digit codes tend to appear on the lock screen of my phone, which means anybody can see them. I can turn that off, I know, but many people will not.
- varunramesh 1y agoAs the author points out, email OTP can be phished if the user is tricked into sending their OTP to an attacker. Email magic links are more phishing resistant - the email contains a link that authenticates the device where the link was clicked. To replicate the same attack, the user would have to send the entire link to the attacker, which is hopefully harder to socially engineer. But magic links are annoying when I want to sign in from my desktop computer that doesn't have access to my email. In that case OTP is more convenient, since I can just read the code from my phone. I think passkeys are a great option. I use a password manager for passkeys, but most people will use platform-provided keys that are stuck in one ecosystem (Google/Apple/MS). You probably need a way to register a new device, which brings you back again to email OTP or magic link (even if only as an account recovery option).
- southp 1y agoI get the point. However, from my own experience this type of one-time passcode is unfortunately the 2nd well-understood authentication method for non-tech people surrounding me. The 1st is the password, of course. I don't know the general situation, but, at least in our small town, people would go to the phone service shop just for account setup and recovery, since it's just too complicated. Password managers and passkeys don't make things simpler for them either –– I've never successfully conveyed the idea of a password manager to a non-tech person; the passkey is somehow even harder to explain. From my perspective it's both the mental model and the extra, convoluted UX that's very hard to grasp for them. Until one day we come up with something intuitive for general audience, passwords and the "worse" one-time code will likely continue to be prominent for their simplicity.
- _1tem 1y agojust stick with passwords then
- danenania 1y agoIf you have password reset via email, as almost every service using passwords does, there’s no security gain over magic links/codes. It’s actually worse, since now the email account or the password get you in, vs. just the email account.
- MetaWhirledPeas 1y ago> If you have password reset via email, as almost every service using passwords does, there’s no security gain over magic links/codes. I disagree. The problem with the magic code is that you've trained the user to automatically enter the code without much scrutiny. If one day you're attempting to access malicious.com and you get a google.com code in your email, well you've been trained to take the code and plug it in and if you're not a smarty then you're likely to do so. In contrast, email password recovery is an exception to the normal user flow.
- 1y ago
- Stratoscope 1y agoI can't be the only person here who is familiar with the word "attestation" in everyday life but had no idea what it means in the context of login security. So I asked my friend Miss Chatty [1] about it. Hopefully this will help anyone who is as confused as I was. https://chatgpt.com/share/68947f35-0a10-8012-9ae9-adadc3df8b6c https://chatgpt.com/share/68947f35-0a10-8012-9ae9-adadc3df8b... [1] Siri and Alexa get to have cool names, so why can't ChatGPT?
- dspillett 1y agoAnd even if proper passwords are used, many sites/apps use this pattern for account recovery if the password is forgotten so effectively this is the only security as an attacker has “forgotten” the password and just uses this flow to login. I've got a little generic login tool that bits I write myself use for login, using this method, but it is not for anything sensitive or otherwise important (I just want to identify the user, myself or a friend, so correct preferences and other saved information can be applied to the right person, and the information is not easily scraped) - I call it ICGAFAS, the “I Couldn't Give A Factor” Auth System to make it obvious how properly secure it isn't trying to be! Another issue that email based “authentication” like this (though one for the site/app admins more than the end user) has is the standard set of deliverability issues inherent with modern handling of SMTP mail. You end up having to use a 3rd party relay service to reduce the amount of time you spend fighting blocklists as your source address gets incorrectly ignored as a potential spam source.
- 0xfeba 1y ago> And even if proper passwords are used, many sites/apps use this pattern for account recovery if the password is forgotten so effectively this is the only security as an attacker has “forgotten” the password and just uses this flow to login. Was about to post just this. This is the flow they use for account recovery so it's the weakest link in the chain anyway.
- ThunderSizzle 1y agoWell, no. I'm more attention to what I'm doing if I have to recover my account. My typical login is something I have to do every day for every place, so it's easy to become more careless subconsciously. Since this is about the human accidentally getting tricked to give a code to a malicious actor, I do think that workflow abuses humans being overtired by too many factors of auth by too many different services. I just want to login and get my thing done, but now I have to spend time waiting on email, etc.
- cnst 1y ago> And even if proper passwords are used, many sites/apps use this pattern for account recovery if the password is forgotten so effectively this is the only security as an attacker has “forgotten” the password and just uses this flow to login. Why is NOONE talking about this? This is exactly why 2FA is less secure than password authentication, because with a password authentication, the attacker actually has to be able to capture the password in some way, whereas with 2FA, effectively anyone anywhere with the skills akin to the most junior private investigator, has the capability and tools to take over anyone's account "protected" by 2FA. Yet we're still being told that 2FA is mandatory because security is important, and that somehow 2FA is still more secure.
- mediumsmart 1y agoI think the registration pattern should be - user enters email to register. email is sent to that email with a link to verify. user clicks link. user gets email with username and password to login in to the profile created for them.
- addandsubtract 1y agoThis reveals the user's password (even if temporary) in plain text in an unencrypted email. Basically the last thing you want. A better workflow is to send the user a link where they can set their initial password themselves.
- mediumsmart 1y agosame thing in blue which additionally opens the door for someone else to change their password and lock them out, never mind the quality of passwords users set initially etc. Looking at you, mum, registering a new account everytime you forget the last password.
- harha 1y agoAlso super annoying if you haven’t set up email on a device (like my iPad), now I have back and forth with my phone instead of going through my password manager.
- amelius 1y agoThis is one of those problems for which a simple solution must exist, but which never gets solved. Just like sending large files over the internet.
- esjeon 1y agoThe actual weak link here is not the procedure itself. It’s the fact that your email services will happily accept phishing mails into your inbox. I’m pretty sure we can prevent this by issuing some kind of proof of agreement (with sender and recipient info) thru email services. Joining a service becomes submitting a proof to the service, and any attempt to contact the user from the service side must be sealed with the proof. Mix in some signing and HMAC this should be doable. I mean, IF we really want to extend the email standard.
- anonymars 1y agoThe email is coming from the legitimate service, it's a man-in-the-middle attack. How does this scheme stop you from putting a legitimate code from a legitimate sender into an illegitimate website?
- esjeon 1y agoAh, sorry, I did get that part, and my idea goes a little bit further, but somehow I thought I wrote enough. One thing is that this problem occurs because we have two independent channels that we must independently verify. I’m pretty sure this is a whack-a-mole game, and will never be possible to fix. Another thing is that, since we don’t trust emails, we hesitate sending links over email. However, the problem here is easy to avoid if services send login links directly to user, and those emails are automatically authenticated by the system.
- anonymars 1y agoBut I think with email login links you have one of several problems: 1. How do you know the email is for a session you actually initiated? In the extreme case, imagine maliciously triggering a login a link for 100,000 users. How many will click the link and get their account taken over? I bet it's nonzero (what's the minimum net you must cast to get access to one account?) 2. Or, what about various software that automatically previews links? A GET request is not secure for this purpose 3. But if you are instead suggesting a link takes you to an authenticated session (rather than authenticating an arbitrary session) now you have the problem that you must log into your email on the device from which you wish to access the account
- dathinab 1y agosure, it being a 6 digit code which has potential for social engineering can be an issue like similar to if you get a "your login" yes/no prompt on a authentication app, but a bit less easy to social engineer but a in turn also suspect to bruteforce attacks (similar to how TOTP is suspect to it) through on the other hand - some stuff has so low need of security that it's fine (like configuration site for email news letters or similar where you have to have a mail only based unlock) - if someone has your email they can do a password reset - if you replace email code with a login link you some cross device hurdles but fix some of of social enginering vectors (i.e. it's like a password reset on every login) - you still can combine it with 2FA which if combined with link instead of pin is basically the password reset flow => should be reasonable secure => eitherway that login was designed for very low security use cases where you also wouldn't ever bother with 2FA as losing the account doesn't matter, IMHO don't use it for something else :smh:
- mschuster91 1y agoI think you misplaced this comment and it belongs here: https://news.ycombinator.com/item?id=44819917 https://news.ycombinator.com/item?id=44819917
- cpcallen 1y agoDid you mean to post this comment at https://news.ycombinator.com/item?id=44819917 https://news.ycombinator.com/item?id=44819917 ?
- ali-aljufairi 1y agoI agree thank you
- djoldman 1y agoRelatedly with respect to passkeys, it seems we have the following tradeoff (simplified): 1. authentication via password: accounts stolen by criminals and then inaccessible to the user. 2. authentication via passkey: accounts lost by users because passkeys have friction, to say the least, when devices are lost/stolen/transferred. It seems that big providers would much rather scenario 2.
- Saris 1y agoI'd much rather have passkeys than the endless "email me a code" or "text me a code" crap we deal with today.
- yunwal 1y agoI need to make a version of https://neal.fun/password-game/ https://neal.fun/password-game/ with increasingly ridiculous second factors.
- csomar 1y ago> An attacker can simply send your email address to a legitimate service, and prompt for a 6-digit code. You can't know for sure if the code is supposed to be entered in the right place. Password managers (a usual defense against phishing) can't help you either. Roughly the same security for password-login with email recovery. The only difference is that this makes the attack surface larger because the user is frequently using email. The only secure login is through 1. a hardware device and 2. a solution where both the user/service are "married" and can challenge each other during the login process. This way, your certificate of authentication will also check that the site you are connecting to is who it says it is.
- 827a 1y agoI've flipped my stance on this. I used to be pretty pro passkey, but after using them for a while what I've observed is: 1. There's very low consistency in implementation, so while I understand the problems passkeys solve, it seems like every vendor has chosen different subproblems of the problem space to actually implement. Does it replace your password? Does it replace MFA? Can I store multiple passkeys? Can I turn off other forms of MFA? Do I still need to provide my email address when I sign in (Github actually says No to this)? 2. The experience of passkeys was supposed to be easier and more secure than passwords for users who struggle to select good passwords, but all I've observed is: Laypeople whose passwords have never been compromised, in 20 years of computing, now deeply struggling to authenticate with services. Syncing passwords or passkeys between devices is something none of these people in my life have figured out. I still know two people in their late 20s who use a text file on their computer and Evernote to manage their passwords. What is their solution for passkeys? They don't know. They're definitely using them though. The average situation I've seen is: "What the heck is this how do I do this I guess I'll just click save passkey on this iOS prompt" and then they can never get back into that service. The QR code experience for authenticating on desktop using mobile barely works on every Windows machine I've seen. 3. There is still extremely low support among password managers for exporting passkeys. No password managers I've interacted with can do it. Instead its to my eyes become another user-hostile business decision; why should we prioritize a feature that enables our users to leave my product? "Oh FIDO has standardized the import/export system its coming" Yeah we've also standardized IPv6. Standards aren't useful until they're used. "Just create new passkeys instead of exporting" as someone who has recently tried to migrate from 1Password to custom-hosted Bit/Vaultwarden: This is the reason why I gave up. By the way, neither of these products support exporting passkeys. It might end up being like USB-C where its horrible for the first ten years, but slowly things start getting better and the vision becomes clear. But I think if that's the case: We The Industry can't be pulling an Jony Ive Apple 2016 Macbook Pro and telling users "you have to use these things and you have no other option [1]". Apple learned that lesson. I'm also reasonably happy with how Apple has implemented Passkeys (putting aside all the lockin natural to using Apple products, at least its expected with them). But no one else learned that lesson from them. [1] https://www.cnet.com/tech/your-microsoft-passwords-will-vanish-in-a-few-hours-what-to-do-right-now/ https://www.cnet.com/tech/your-microsoft-passwords-will-vani...
- Bender 1y agoI don't like any of the methods used today. Passwords are OK for me since I pick strong pass phrases, use different emails per site but for me the superior option for me is IP/CIDR restrictions. A small handful of sites support it and some of those don't expose that they do because some people think a long DHCP lease is a static IP and that can cause a customer support ticket. It was a battle but I have managed to get some financial institutions to enable it for me. Every bank big and small can do this but tellers and bankers have no idea, only their IT person. When that fails I just disable internet access to my account from the financial institutions and go talk to a real person face to face. If that isn't an option I just don't do business with them. Simple as. I do 99.999999% of my internet access from home but if I depended on mobile I would have a VPN back to my home to utilize my static IP from a Linux laptop. I do not browse the internet from a cell phone and never will. Not perfect, nothing is.
- 12ian34 1y agowow your threat model is very different to me
- Bender 1y agowow your threat model is very different to me If what you mean is that you have no online accounts then you are a few steps ahead of me. I will get there eventually but have some things to take care of first. Congrats on disconnecting from the internet though. I assume this site is your last holdout? I am envious if so. This site will also be my last online presence.
- browningstreet 1y agoI just deleted my gofundme because they kicked me into this cycle today. Somehow I've managed to have an account there and make contributions over the years, but now they wanted my phone number and an MFA code to proceed, and there was no opt-out. I went through it but then deactivated my account. I need less of this in my life, and gofuneme is not essential to my life. I'm in the rental market right now, and Zillow not only has a log-in for the app, but to read messages in your inbox, you have to MFA again each time, and the time-out period is about an hour. We're being annoyed to death. This is madness.
- bsimpson 1y agoTicketmaster did the same. They don't accept Google Voice numbers, yet my only number is Google Voice. The number tied to my SIM is an implementation detail that changes depending on where I am, but it's the only way I can get into that account now. My choices are to not go to events that are ticketed by them, or accept that I'll probably be locked out whenever I change SIMs.
- cnst 1y agoSMS is literally the least secure form of authentication, because numbers expire after mere weeks, and get re-assigned shortly, within months, because of number shortage in many area codes. Nothing like this could happen with any mainstream mail service like Gmail, where it's officially advertised that the accounts could never be reused. The worst part about SMS is that not only is there the potential to be locked out permanently, but also you never know whether or not the service would allow login or password reset via SMS, thus, you never know if you're opening yourself to account takeover.
- qingcharles 1y agoGoogle turned on 2FA on my account themselves, but the phone number on the account is outdated, so I was permanently locked out.
- elif 1y agoThis also doesn't address my biggest concern, google controls the chrome password manager and probably controls your email address. At a bureaucratic sneeze you can be denied access to your entire life.
- teeray 1y agoWe need something equivalent to "Americans will use anything but the metric system" but "Sites will force users to use anything but a password manager."
- Jean-Papoulos 1y agoI don't get it. How is mistakenly giving a one-time login to a malicious actor worse than giving it a permanent login (aka your password) ?
- seagnson 1y agoThis article really opened my eyes to how phishing can exploit email verification codes. The shift towards using keys instead of passwords sounds promising for security. It's scary how easily users can be tricked, but your point about preferring security over convenience is spot on. Great read!
- andix 1y agoI'm always baffled that magic links is the only way to sign in to Anthropic Console or Claude. No passwords, no passkeys, nothing. They do provide Google sign-in, but I've had issues with Google sign-in during traveling too often to consider it a legitimate option.
- exabrial 1y agoPublic Shaming: Ally Bank, made this mandatory. I'm leaving them as soon as I can find a another bank with 3.x% on savings, bill pay that automatically retrieves bill amounts, and supports _at least_ TOTP. Suggestions welcome if anyone has them.
- kccqzy 1y agoI use Schwab (bank and brokerage). Their money market funds yields 4.x% with just a few more clicks to move into and out of the MMF. The Bill Pay retrieves the amount on my BofA credit card just fine. And it supports TOTP via Symantec VIP Access (it doesn't seem like you can use a standard TOTP app).
- jonbiggums22 1y agoThis is why I think people ending up locked into vendor implementations of passkeys will be a thing. We had a totally open standard, TOTP, and there were still (somewhat successful) efforts make it non-standard like the Symantec VIP Access you mentioned. How many authenticator apps do I have to install? I was hoping for one! FWIW when I was researching this for my own accounts I believe I saw in passing that someone had figured out a way to extricate the TOTP secret from VIP Access to use in a standard TOTP app. I didn't look into it much though since none of my current accounts require it and it just seemed something to avoid.
- exabrial 1y agoThanks! that's actually much closer to what I'm looking for. pip install python-vipaccess looks like it'll provision new token, form which you can then use the secret in a regular TOTP app. Wonder if that could be used to sidestep the proprietary app
- exabrial 1y agohttps://news.ycombinator.com/item?id=27692315 https://news.ycombinator.com/item?id=27692315 looks like you can!
- valianteffort 1y agoAuthor seems confused. 2FA isn't about securing your account, it's about harvesting your phone number.
- jondusaza 1y ago[dead]
- jondusaza 1y ago[dead]
- marifjeren 1y ago> This is terrible for account security It's "terrible" because the author can describe exactly one phishing vector?.. Have you ever tried resetting a password before? Passwords have a similar phishing vector, plus many other problems that magic links and one-time login codes don't have. If six-digit login codes are less secure than passwords, the reasons why are certainly not found in this article.
- a3w 1y agoTo be fair, it can be even funnier: The "Simply" music apps use a four digit code, sent by mail. And that never changes. Easy account sharing! It is a feature!
- asimpletune 1y agoI guess this is one reason why magic links are slightly better than being emailed a code.
- sholladay 1y agoFrom a design perspective, the reason this flaw exists is because the code can be typed on any machine and sent through any intermediary. More secure schemes are possible without much effort. Magic links have some pros/cons but overall I think they are better. Here is what I do when the user logs in and email verification is needed: 1. Generate a UUID on the server. 2. Save the UUID on the client using the Set-Cookie response header. - The cookie value is symmetrically encrypted and authenticated via HMAC or AES-GCM by the server before it is set, such that it can only be decrypted by the server, and only if the cookie value has not been tampered with. This is very easy to do in hapi.js and any other framework that has encrypted cookies. - Use all the tricks to safeguard the cookie from being intercepted and cloned. For example, use a name with the __Host- prefix and these attributes: Secure; HttpOnly; SameSite=Lax; 3. The server sends an email to the user with a link like https://site.com/verify?code=1234 https://site.com/verify?code=1234, where 1234 is the UUID. 4. The user clicks the link and has their email verified. - When the link is clicked, the browser sends the Cookie header automatically, the server decrypts it and compares it to the UUID in the URL and if that succeeds, the email has been verified. Again, this is very easy in hapi.js, as it handles the decryption step. - Including the UUID in the magic link signals that there is _supposed_ to be a cookie present, so if the cookie is missing or it doesn't match, we can alert the user. It also proves knowledge of the email, since only the email has access to the UUID in unencrypted form. 5. The server unsets the cookie, by responding with a Set-Cookie header that marks it as expired. 6. The server begins a session and logs the user in, either on the page that was opened via the link or the original page that triggered the verification flow (whichever you think is less likely to be an attacker, probably the former). Note that there are some tradeoffs here. The upside is that the user doesn't need to remember or type anything, making it harder to make mistakes or be taken advantage of. The downside is that the friction of having to use the same device for email and login may be a problem in some situations. Also, some email software may open a different browser when the link is clicked, which will cause the cookie to be missing. I handle this by detecting the missing cookie and showing a message suggesting the user may need to copy-paste the link to their already open browser, which will work even if they open a new tab to do it (except for incognito mode, where some browsers use a per-tab cookie jar). Lastly, no cookie is 100% safe from being stolen and cloned. For example, a social engineering attack could involve tricking the user into sharing their link and Set-Cookie header. But we've made it much more difficult. They need two pieces of information, each of which generally can't be intercepted, or used even if intercepted, by intermediary sites.
- SergeAx 1y agoHow's that different from the trivial phishing, when a malicious site looks like the target site and asks for the password?
- igtztorrero 1y agoAfter all big companies has change to sms code authentication, we just realized this is a bad pattern, please take out all that y get back to "click a link in this mail" pattern, looks more secure.
- deleted 1y ago[deleted]
- codethief 1y ago> This is terrible for account security It's also terrible UX. Emails don't always arrive right away. (Especially if you've enabled greylisting.)
- bangaladore 1y agoThis is a fundamental flaw with any login flow that is not phishing resistant. There is nothing novel about this attack. An attacker can register a domain like office375.com, clone Microsoft's login page, and relay user input to the real site. This works even with various forms of MFA, because the victim willingly enters both their credentials and second factor into a fake site. Push-based MFA is starting to show IP and location data, but a non-technical user likely won’t notice or understand the warning and a sophisticated attacker will just use a VPN matching the users' location anyways. Passkeys solve this problem through origin enforcement. Your browser will not let you use a passkey for an origin that the passkey was not created for. If they did, you could relay those challenges as well (still better than user + pass as the challenges are useless after first use).
- bArray 1y agoI think I have said the following till I go blue in the face: 1. Mobile phone numbers are not secure. SIM jacking is a thing, and a 6 digit code is not impossible to guess (it's only 1 in a million). 2. Sending codes/links via email is problematic as described by the article. 3. Inconsistent "best practices" confuse users, and frustrate them.
- amai 1y agoWho thought having no passwords would be a good idea? Microsoft? Why am I not surprised. https://support.microsoft.com/en-us/account-billing/how-to-go-passwordless-with-your-microsoft-account-674ce301-3574-4387-a93d-916751764c43 https://support.microsoft.com/en-us/account-billing/how-to-g...
- nobodywillobsrv 1y agoFrom my experience, OTAC is typically associated with sites that want to prevent automation and scraping. By that I mean I have seen it being used at EACH log in to create extra friction. Interesting this is being used as part of "regular" security.
- jamigeo 1y ago[flagged]
- jamigeo 1y ago[flagged]
- macrocosmos 1y agoThe idea of needing to provide extremely personal information that’s somehow tailored for me just to use a service is so incredibly dystopian to me. I’d much rather use a password.
- Oceoss 1y agothen maybe for auth: login link > password > one time code ? hard to be 100% confident
- 1970-01-01 1y agoWe need a security standard that disallows using email as ID.
- jemiluv8 1y agoCan OP tell us how they implement one-time code email? Ever heard of PKCE flow applied to otp auth where there is a guarantee that the top flow can only be completed using the device/browser on which the user initiated the request? Consider this scenarioUser initiates login on your site. 1. You generate a code_verifier (random) and a code_challenge = SHA256(code_verifier) and store the code_verifier in the browser session (e.g., local/session storage, secure cookie, etc.). 2. You send the code_challenge to the server along with the email address. 3. Server sends the email with a login code to the user, recording the challenge (associated with the email). 4. User receives the email and enters the code on the same device/session. Client sends the code + code_verifier to the server. Server verifies: Code is correct. SHA256(code_verifier) == stored code_challenge. The end result is that The code cannot be used from another device or browser unless that device/browser initiated the flow and has the code_verifier. A combination of the above and a login link might help. But ultimately, the attacker will be relying on the gullibility of the user. The user will have to not check the urls Assuming the bot knows to send a code_challenge and send the code_verifier together with the verification code But then again, GOOD can just also ensure that their otp can only be completed from the GOOD domain/origin. That would shore things up at least.
- parliament32 1y agoI went hunting in the NIST documentation to see if this is even an approved authentication method and, technically, I can't find anything wrong with it (if we consider it to be a "Look-up Secret Authenticator", see NIST 800-63b section 5.1.2.1). They're technically abusing what is supposed to be a collection of pre-distributed authenticators (think recovery codes), but there's nothing prohibiting these look-up codes from being sent on-demand and there only being a single selection. As for the method itself.. IMO they're certainly phishable, but I don't think they're any more phishable than a typical username/password prompt. > An attacker can simply send your email address to a legitimate service, and prompt for a 6-digit code. You can't know for sure if the code is supposed to be entered in the right place. An attacker can also simply present a login prompt, say a Google-looking one, and a user will just enter their credentials. This is why phishing-resistant authentication is the one true path forward.
- iaalm 1y agoSometimes it just feels like they are trying to to block you from using script/code to use their services.
- ivanjermakov 1y agoRelated: SMS 2FA is not secure https://news.ycombinator.com/item?id=27447206 https://news.ycombinator.com/item?id=27447206
- WriteValda 1y agoIF everyone switches to PASSKEYS, hackers are going to focus exclusively on them and they WILL find a way; then everyone will be FUBAR. Worse, BIG TECH is not going to take responsibility. THAT and AI? PROBLEMATIC. Nothing is foolproof. However... Proper password protocol must be taught.Once upon a time, people had password hints. Why not tech a combination of that and proper passwords?
- zahirbmirza 1y agoWhere are the big tech founders who are proponents of this method on their platforms? I would like to hear their justification.
- cnst 1y agoWhat about all those services that force you to enable 2FA with SMS? How could you possibly know whether or not that opens you up to these SIM swap attacks?
- Friedduck 1y agoI only have a couple of services that use this pattern and I’m cancelling them out of frustration. If i use a personal email then I can’t access it on corporate machines and vice versa. Theres so much friction in the process it’s not worth maintaining the service.
- hakerA1 1y agoHey
- hakerA1 1y agohey