News for hackers. Stuff that matters.

A comment on Magic/tragic email links: don't make them the only option. Parent comment

Re:Magic/tragic email links: don't make them the only option by edoceo on Tuesday January 07, 2025 @08:46PM (#42630024)
When I sign on to a bank it sends an SMS. Then my phone prompts me to share that code with the brower, on my desktop. It's a neat QOL "feature" - but kinda feels too automated to be secure.
[ Parent | on HN ]
Re:Magic/tragic email links: don't make them the only option by lupire on Tuesday January 07, 2025 @08:57PM (#42630084)
That's because the server recognizes both clients, and you are prompted to approve the other client from the client that has the code. You are giving permission to the remote client, not taking permission from the remote client.
[ Parent | on HN ]
Re:Magic/tragic email links: don't make them the only option by edoceo on Tuesday January 07, 2025 @10:14PM (#42630506)
The server recognized my device from the messenger/SMS app? That seems not correct.

But somehow, the desktop browser and my mobile are tied together for this app. But no other sites have this magic.

[ Parent | on HN ]
Re:Magic/tragic email links: don't make them the only option by happyopossum on Wednesday January 08, 2025 @03:49AM (#42632323)
If you have an iPhone and a mac, most sites that use SMS OTPs work this way
[ Parent | on HN ]
Re:Magic/tragic email links: don't make them the only option by edoceo on Wednesday January 08, 2025 @09:35AM (#42634662)
Linux desktop, android phone.
[ Parent | on HN ]