Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I used Ory Kratos in a Go application a couple years ago by installing it as a dependency. It worked pretty well but in hindsight I would have hosted it as a separate application because it was a pain to bring along all of its dependencies.

One of my biggest complaints was that one of the Account Recovery flows was just an emailed 6-digit code. So a 1 in 1 million chance that somebody without access to any of your stuff could hack you by just hitting reset and guessing "123456". It's actually surprising how many other Account Recovery flows across the web I have noticed recently that do the same thing. Not sure if Ory has added the option for more entropy in this code as of today's release though it's been a while since I've used it.

Otherwise it was a great project to work with that has tons of knobs to customize. I commend the authors, aeneasr especially. It must be a ton of work to keep up with all of the auth standards and offer this in an Apache2 licensed package all while building a business around it as well!



Aren’t these codes supposed to have a timeout, like you have to use them within 10 minutes or they become invalid?


Sure, but say the implementation lets you try 5 codes in that 10 minutes with a 30 minute lockout. An attacker could trigger Account Recovery, blindly try 5 six-digit codes immediately, and have a 0.0005% chance getting into your account.

They could script this to run over a long period of time targeting 1 account, or they could target many accounts at once, and would probably have success.


This is my biggest gripe with email auth or any kind of security code via sms/mms. I pray for the day I can fully move to a passwordless setup and break free the mess of email addresses spaghetti and phone numbers.


It’s probably easier to just have an exception log when someone(s) have 100 bad password attempts in a day or whatever.


Feel free to implement something that sends a UUID, and deal with the complaints instead.


I've implemented otp codes / magic links many times now. They absolutely always have a timeout. Say 30 minutes.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: