3 ms·
Add the lie "emails are delivered instantly, so the user can click a link I email them within 1 minute" And the lie "users always read emails on the same devic
by amiga386 5mo ago
Add the lie "emails are delivered instantly, so the user can click a link I email them within 1 minute"
And the lie "users always read emails on the same device they're logging into a website with"
And the lie "users can always view HTML email so no need to send a plaintext equivalent, especially if I have a long complex URL I want them to click"
And the lie "Clickable links sent in email are more secure than passwords so I'll stop supporting passwords and instead rely on email delivery of a link for all logins. Whoever clicks that link first is definitely the user who wanted to log in"
- deleted 5mo ago[deleted]
- wodenokoto 5mo agoIf you have a password reset form, you probably already have a log-in with email with extra steps functionality.
- CPLX 5mo ago> Clickable links sent in email are more secure than passwords so I'll stop supporting passwords and instead rely on email delivery of a link for all logins God, I fucking hate that. I have a fucking password manager, I have various machines and things open. Just let me fucking log in. If anyone is reading this who is in charge of the internet please stop doing this.
- denkmoon 5mo agoThe people in charge of the internet are "cybersecurity" "professionals" who can't even follow NIST guidance.
- readthenotes1 5mo agoThe "change your password every 6 months" guidance?
- Kaliboy 5mo agoIt is with much hesitation that I write this, because I just implemented such a flow. My reasoning was this: my customers keep forgetting their password and somehow that becomes a trigger to contact me. No passwords, no problem. I tried convincing them to use password managers but that was pointless. But I see the pain and frustration so I will add passwords. And I quite liked the passkey idea, have to see how that works. Not that my customers would ever use it, but I would. It literally never occured to me.
- denkmoon 5mo agoTo be clear, no shade on actual devs faced with actual problems. My ire is reserved exclusively for the "we must do this because it is on the checklist, no I don't understand what a subnet is" people.
- butvacuum 5mo agoGood to see my take verified. But, where does the buck stop? What if your phone relies on email, but your email needs your phone.
- technion 5mo agoA lot of those same people seemed perfectly capable of insisting on 60 day password rotation back when they could use nist guidance as an authority to appeal to (for about five years after the recommendation changed too).
- roygbiv2 5mo agoI seem to spend half my life logging into thing's, confirming 2fa,confirming biometric data. Then when I go back to the first thing it's timed out and I have to sign in again.
- anon7000 5mo agoSo agreed. It’s fucking crazy. Password manager is so much easier and more secure. If you do this dumb email or SMS OTP flow, at LEAST support passkeys for my password manager! It’s wild that they’re like “it’s more secure to not have a password” and then choose two unencrypted delivery mechanisms for the very short OTP. Sure, people who reuse passwords are not secure. And fair, I guess it’s a tragedy of the commons. But at least continue supporting it and make it dead simple for password managers if you actually care bout security
- 8n4vidtmkvmk 5mo agoI thought the same for a long time but now i don't know. If your computer is compromised, they can exfiltrate your password, but with a hardware key they can't, so i think that's legitimately more secure than password+otp. It still needs a pin though to protect against device theft. I bring this up because there's been a ton of compromised developer packages recently and windows itself is being attacked so even if you're pretty good about protecting yourself, you still might get screwed.
- nvme0n1p1 5mo agoIf your computer is compromised, the attacker can just as easily read your email. OTP can be used with a password.
- hdjrudni 5mo agoUh huh? That's why I specifically said hardware key. Like a Yubikey. You can't digitally steal that.
- akimbostrawman 5mo agoThat doesn't address anything. If your device is compromised they do not need your hardware key because they can just read all mails on device or steal login/session cookies for accounts and bypass authentication. Passkey is still inferior to U2F + password anyways.
- Terr_ 5mo agoThere's a landlord/apartment portal where the whole login process has changed to be: 1. Enter username (e.g. an email) 2. Choose from either email or SMS on file 3. Enter the code you got somehow through the respective unencrypted channel Given that this same site is involved with bank-account details for payment, I am concerned...
- BobbyTables2 5mo agoIt’s really rich when banking/finance apps are fully happy doing 2FA to the phone when using its own browser… Yeah — loose the phone and it’s pretty much game over.
- Terr_ 5mo agoI don't think it should be the sites' responsibility to guess whether the browser session is the have device will receive an SMS message... The fact that it is SMS is already bad anyway. Time-code apps or passkeys are a different story. 1. You should be able to make backups. 2. There's nothing to intercept in plaintext. 3. The all can (unlike SMS features) be locked down by default and require a second layer of unlocking, so that they usually aren't accessible to someone who grabs your phone out of your hand.
- account42 5mo agoIt absolutely should be the Bank's concern when this is how 99% of their customers will use it. Some even have deliberate integration between the baking and 2FA apps.
- paradox460 5mo agoI'll heap email and sms based otp into that I have many ways to generate totp codes. All of them are vastly more convenient than sending me an email or sms
- trumpdong 5mo agoIf you try to create a Discord account with Firefox Klar as your default browser, on Android, immediately upon signing up you'll be banned. I have to assume this is because it clears cookies and thinks you're a bot farm.
- nosioptar 5mo agoWhen I had protonmail, I often wouldn't get emails for hours, sometimes a day. Most other providers I've used range from instant to a few minutes.
- Terr_ 5mo ago> And the lie "users always read emails on the same device they're logging into a website with" Or the same browser, or the same browser-profile. For example, on my phone I have external links (from other apps) opening in incognito mode by default.
- butvacuum 5mo agoI don't think it's about security. It's about fobing off password resets on somebody else.
- tatersolid 5mo agoThis is market-dependent. We offer email OTP login for small business customers because it is “poor man’s SSO”. You’re basically validating the recipient is still at the company, able to receive at their work email. Larger customers have IT staff and set up OIDC or SAML with us. We don’t add an SSO tax.
- technion 5mo agoClaude, for my non Gmail domain, expects me to click a magic link on every device I wish to use it. Its wild that a product like that cannot take a password, or a passkey.
- JdeBP 5mo agoI'm surprised that this has not triggered all of the reminiscences of sitting running mailq at intervals for hours to watch mail that hasn't even left the local sending machine yet.