Comment by mbwgh | Hacker News Reader

Comment by mbwgh | Hacker News Reader

I am probably going to get flak for this, but this "scam flow" including a forged Microsoft login, is pretty much the problem I had when I first encountered OAuth and the "Login with XY" concept.

Aside from the fact that I can't keep the way the auth flow works in my head for longer than 2 days before my understanding of it becomes fuzzy again, a layman is not supposed to understand what's going on at all. Because if they were, they would ask "does this service get my XY password if I enter it here?" and unfortunately, trying to get this answer will lead them down a rabbit hole of auth flows, OAuth2 vs. OpenIDConnect and whatnot, because it's only ever documented for implementers.

The normal user is to just believe in its trustworthiness, which may on a technical level be warranted or not, that's not the point. If you keep logging in with XY to different services, you become conditioned to not question anymore whether it's correct to enter your password right now, and where the login form, which always looks the same across different services, comes from.

But oh well, I don't know what the solution should be here, maybe mandatory 2FA yet again, or passkeys. The market will decide.

Yeah, I really agree with this

I get lots of unsolicited "Microsoft Login" popups and even as a sophisticated user, there's no satisfactory way for me to establish whether this is a trustworthy request or a fake login page.

For example, my company's VPN uses Microsoft SSO and will occasionally pop up a Microsoft Login window without me having requested it.

I establish trust via the autofill of my password manager. If my password manager doesn't offer a list of my Microsoft accounts for autofill, it's probably not a Microsoft website.

Yes, this is not bulletproof, because some companies have login pages on multiple domains. But at least it fails safely and causes me to become cautious when that happens.

Basically a devil's advocate: I have a person in my family, a personal computer user since 80s-90s, who still can't fully understand the concept of authentication realms, i.e. news.ycombinator.com.

From my observations, they would try to type in "the" username and password to "unlock" the system everywhere, and in the process realizes that special instruction applies, and jumps to an ever growing switch-case statement in the exception handler, that routinely skips and punches through the bottom. No matter what or how I speak about an identity being a set of [domain,id,secret], it would not stick. The schema was carved in stone long ago and isn't changing. I've naturally tried converting them to a password manager, it didn't matter. Falling into installing WinZip, twice, and subsequently paying for it was far easier than using it, apparently. Whenever a login process could not be completed, the system is considered to have "became unusable", and signup flow is repeated to again "unlock" the system.

To include such kinds of common people, reducing situations that realms matter is crucial. Passwordless login such as SMS and e-mail magic links is one way, password sharing among websites(dangerous) is another, and OAuth/OpenID/federated login is among those.

A user that feel uneasy typing XY account passwords on a browserish popup that claims to be a part of the legitimate "Login with XY" flow is not a normal user. That is a competent, near-developer power user.

> I don't know what the solution should be here

A separate password for each site works fine. 2FA is mostly a PI grab for spyware anyways. E.g. "Login with Google" is spyware.

I want 2FA for my bank only.

"Login with X" is OAuth, not 2FA. 2FA is a great addition on top of a password per site. Neither a FIDO device nor an Authenticator app provides the site with any extra PI.

Edit: SMS would give them your phone number, but SMS is a really bad 2FA and should not be used

I'm not so sure this is the case. Even less safe 2FA like SMS and email seems to prevent a whole host of cheap attacks. TOTP is much better and can be as anonymous as your login is.

What is sad is that misuse of 2FA data is rampant and causes people to think (rightfully so) as you do.

I don't want MFA everywhere either. I said recently that KYC has gotten out of control. HN doesn't rise to the level of Yubikey. Reddit shouldn't have fingerprints. Musk can kick rocks with collecting PII and employment history.

To your point, the market will decide, but I'm hopeful passkeys will ultimately be one of the key solutions here. Already seeing a lot more app adoption (e.g. Shopify, Google, Docusign) than original webauthn given some of the UX problems that brought with it

Reply on news.ycombinator.com