3 ms·
I like the idea, but doesn't it come with a few security concerns? One blaring issue is that email is sent in plain text, so anyone can intercept it and log in
by stanmancan 11y ago
I like the idea, but doesn't it come with a few security concerns? One blaring issue is that email is sent in plain text, so anyone can intercept it and log in as you.
I was originally going to complain that anyone who has access to your email now has access to all of your accounts, but upon further thought I don't know how much of a concern this really. First, the vast majority of people use the same password everywhere anyways. Second, most services use your email to reset your password anyways. The only security difference I can think of is if someone uses your email for a password reset and changes your password, it becomes very obvious there might have been a security issue when you try to log in and your password doesn't work. If all someone has to do is follow the link, there's nothing to create that suspicion.
A few other things to consider:
- How long does the token emailed to you last for?
- If I send a new token, do previous sessions expire?
---- If so, how can I be logged in via multiple browsers/computers?
---- If not, does an attacker have permanent access to my account if they got access to a single link?
- WorldMaker 11y agoLinks would be one-time-use tokens, just as with existing password reset links. Security footprint is essentially the same as today.
- joeyh 11y agoWhen I implemented this, I made the following choices: 1 hour login email expire time by default, tunable. I'd make it shorter, but it has to get around greylisting. Sending a login mail and logging in does not affect existing browser sessions. Only allow a login email to be used one time. Only allow the last login email sent to be used, not old ones. This and the expiry keep email archives from becoming a problem. Another thing you could do is set a cookie and have the login link check for the cookie. That makes the link worthless even if the attacker intercepts it. But, it lets the attacker DOS a user and prevent them from logging in by continually requesting new login emails, so you'd probably want to allow previous login emails to be used. Of course, as a user, how do I know which of these security tradeoffs a site has chosen? It's as bad as using a password and hoping they don't store in clear text. It would be better to have a protocol for login that makes clear choices.
- Natanael_L 11y agoI prefer hardware tokens like U2F
- hakcermani 11y agoI did the same with my app Piclr too. I have a timed expiry as I found people do not immediately sign up. Still tweaking it a bit. True now the email is a single point of failure, but 2 factor will help here. (https://itunes.apple.com/app/id889978045 https://itunes.apple.com/app/id889978045) Improving the world - with one password less at a time :-)