We replaced passwords with something worse

The post argues that the common login flow based on an email address or phone number plus a 6-digit code is a bad replacement for passwords. It says this setup makes account security worse because users cannot tell whether the code is being requested by the real service or by an attacker.

It also says password managers do not help against this kind of phishing. The author points to Microsoft’s Minecraft account login as an example of the method being used in the wild, and says many accounts have already been stolen.

Reading notes

#

• Many services now use a login flow where the user enters an email address or phone number, receives a 6-digit code, and uses that code to log in.
• The author says this should stop because it is terrible for account security.
• An attacker can send the victim’s email address to a legitimate service and trigger a 6-digit code prompt.
• The user cannot know for sure whether the code belongs in the right place.
• Password managers, which usually help against phishing, do not help here.
• Microsoft’s Minecraft account login uses this method.
• The post says many accounts have already been stolen through this attack method.