4 ms·

Not TOTP but a bunch of sites are doing this thing where they send an OTP to the registered email and have eliminated passwords altogether. I find it really ann

by ksynwa 2y ago

Not TOTP but a bunch of sites are doing this thing where they send an OTP to the registered email and have eliminated passwords altogether. I find it really annoying.

yurishimo 2y ago
It is annoying but it generates far fewer support requests for people who can't remember a password and think resetting it is too difficult. With a long enough session life and a good refresh strategy, it's less of a problem. If an app clears sessions after a week, then I would argue they are doing it wrong.
- ksynwa 2y ago
  I think they also want to thwart folks like me who are possibly going to use a temporary email site to make an account.
  - mdaniel 2y ago
    Depending upon one's threat model, I found that the "public" version of throwaway emails still work great for that purpose, versus sites like 10minutemail which destroy the address after a time. Sure, I am cognizant that if I just went surfing around (e.g.) https://www.mailinator.com/v4/public/inboxes.jsp?to=ksynwa https://www.mailinator.com/v4/public/inboxes.jsp?to=ksynwa long enough I could probably snag any hypothetical login link to HipsterLoginLink.co but in practice I doubt it's an issue
account42 2y ago
That's how I use random sites for which I can't/won't use my main browser - just set a random password and don't save it anywhere, then rely on email password resets to login.
caleblloyd 2y ago
It blows my mind that a 6 digit code is considered a secure replacement for a password on these sites. Only a 1 in 1 million chance of brute forcing. Seems rather simple for a motivated actor with a botnet targeting a large list of accounts to have some degree of success.
- fragmede 2y ago
  Any competent IPS system would lock out a botnet, and it rotates, so you need to guess the right 6 digits within 90 seconds 30 plus 30 on both sides) until it's a different set of 6 digits.

by ksynwa 2y ago

Not TOTP but a bunch of sites are doing this thing where they send an OTP to the registered email and have eliminated passwords altogether. I find it really annoying.

yurishimo 2y ago

It is annoying but it generates far fewer support requests for people who can't remember a password and think resetting it is too difficult. With a long enough session life and a good refresh strategy, it's less of a problem. If an app clears sessions after a week, then I would argue they are doing it wrong.

ksynwa 2y ago
I think they also want to thwart folks like me who are possibly going to use a temporary email site to make an account.
- mdaniel 2y ago
  Depending upon one's threat model, I found that the "public" version of throwaway emails still work great for that purpose, versus sites like 10minutemail which destroy the address after a time. Sure, I am cognizant that if I just went surfing around (e.g.) https://www.mailinator.com/v4/public/inboxes.jsp?to=ksynwa https://www.mailinator.com/v4/public/inboxes.jsp?to=ksynwa long enough I could probably snag any hypothetical login link to HipsterLoginLink.co but in practice I doubt it's an issue

account42 2y ago

That's how I use random sites for which I can't/won't use my main browser - just set a random password and don't save it anywhere, then rely on email password resets to login.

caleblloyd 2y ago

It blows my mind that a 6 digit code is considered a secure replacement for a password on these sites. Only a 1 in 1 million chance of brute forcing. Seems rather simple for a motivated actor with a botnet targeting a large list of accounts to have some degree of success.

fragmede 2y ago
Any competent IPS system would lock out a botnet, and it rotates, so you need to guess the right 6 digits within 90 seconds 30 plus 30 on both sides) until it's a different set of 6 digits.