6 ms·

This seems to make urls themselves passwords, and your email a password safe.

by d0lph 11y ago

elcapitan 11y ago
True, but arguably whoever can access your email could just as well use password reset functionality for a given site you are using. The generated url-login-tokens on the other hand will be long random strings and harder to impossible to crack.
WorldMaker 11y ago
These are one-time use tokens, just like you should use for a "Forgot Your Password" email login. It's literally the same steps, just there's no new password to input, the website just gives you a login cookie and you can go about your day.
- mattashii 11y ago
  The point is that the most commonly used e-mail protocols do not have safety built in. The solutions for this problem (e.g. PGP signing) are not adapted widely enough to be considered adapted by the market. If you'd want to use two-factor authentication by verifying access to the mailbox, you have to make sure that that (the connection to) the mail box is safe as well, which can potentially be very hard. The mailbox still is a safe, but only from the moment that the mail has been sent to the moment the page has been requested. Mind that a safe connection to your mailbox does not also mean a safe connection to the server, but that is something that is covered by https+certificates (mostly).
  - WorldMaker 11y ago
    This is no worse a security footprint than the existing, requisite "Forgot Your Password" flow. It's the exact same security footprint. TLS is already an under-spoken requisite of SMTP communications from any webserver doing "Forgot Your Password" workflows. TLS between mail servers is also already a de facto SMTP requirement for most bare minimum spam fighting mechanisms.
    - mgreg 11y ago
      True that the password reset and the "login" using this proposal travel the same path and present the same attack vector but there is some disadvantage to the frequency in which the "login" system would travel down this less-than-secure path. The more times you use this the more likely that someone will just happen to be watching and waiting at the right time. Let's not forget that most of the email system is still not encrypted (last time I checked anyway) even though the last mile between your mail server and your client may be.
      - WorldMaker 11y ago
        Frequency is also essentially the same: you can request a new login token equally as often as you can request a new "Forgot Your Password" token in that they are both manually requested with only an email address. There are also already a growing number of users that use "Forgot Your Password"-only login (most accidentally; human memory is porous) day to day. Which is not to say that we shouldn't make email better and more secure, but that the security of our email infrastructure is a red herring of sorts in the larger security discussions of "passwordless" login, given that we are already equally insecure in every website that has a "Forgot Your Password" button that accepts anyone's email address.
      - jessaustin 11y ago
        An attacker who can "watch", can also click the "forgot my password" button whenever she happens to be watching.
  - mynameisvlad 11y ago
    As elcapitan pointed out, if your email, or even the route mail takes to get to you, was compromised then an attacker would already have access to your accounts by simply forcing a password reset.

This seems to make urls themselves passwords, and your email a password safe.

by d0lph 11y ago

This seems to make urls themselves passwords, and your email a password safe.

True, but arguably whoever can access your email could just as well use password reset functionality for a given site you are using. The generated url-login-tokens on the other hand will be long random strings and harder to impossible to crack.

WorldMaker 11y ago

These are one-time use tokens, just like you should use for a "Forgot Your Password" email login. It's literally the same steps, just there's no new password to input, the website just gives you a login cookie and you can go about your day.

mattashii 11y ago
The point is that the most commonly used e-mail protocols do not have safety built in. The solutions for this problem (e.g. PGP signing) are not adapted widely enough to be considered adapted by the market. If you'd want to use two-factor authentication by verifying access to the mailbox, you have to make sure that that (the connection to) the mail box is safe as well, which can potentially be very hard. The mailbox still is a safe, but only from the moment that the mail has been sent to the moment the page has been requested. Mind that a safe connection to your mailbox does not also mean a safe connection to the server, but that is something that is covered by https+certificates (mostly).
- WorldMaker 11y ago
  This is no worse a security footprint than the existing, requisite "Forgot Your Password" flow. It's the exact same security footprint. TLS is already an under-spoken requisite of SMTP communications from any webserver doing "Forgot Your Password" workflows. TLS between mail servers is also already a de facto SMTP requirement for most bare minimum spam fighting mechanisms.
  - mgreg 11y ago
    True that the password reset and the "login" using this proposal travel the same path and present the same attack vector but there is some disadvantage to the frequency in which the "login" system would travel down this less-than-secure path. The more times you use this the more likely that someone will just happen to be watching and waiting at the right time. Let's not forget that most of the email system is still not encrypted (last time I checked anyway) even though the last mile between your mail server and your client may be.
    - WorldMaker 11y ago
      Frequency is also essentially the same: you can request a new login token equally as often as you can request a new "Forgot Your Password" token in that they are both manually requested with only an email address. There are also already a growing number of users that use "Forgot Your Password"-only login (most accidentally; human memory is porous) day to day. Which is not to say that we shouldn't make email better and more secure, but that the security of our email infrastructure is a red herring of sorts in the larger security discussions of "passwordless" login, given that we are already equally insecure in every website that has a "Forgot Your Password" button that accepts anyone's email address.
    - jessaustin 11y ago
      An attacker who can "watch", can also click the "forgot my password" button whenever she happens to be watching.
- mynameisvlad 11y ago
  As elcapitan pointed out, if your email, or even the route mail takes to get to you, was compromised then an attacker would already have access to your accounts by simply forcing a password reset.