5 ms·
If you're responsible for running a website, how are you going to be resilient against attackers who come to your site with legitimate usernames and passwords o
by 1ba9115454 8y ago
If you're responsible for running a website, how are you going to be resilient against attackers who come to your site with legitimate usernames and passwords of your members?
One way is to email the user when they log in from a new device or computer.
They then have to enter a 6 digit one time password from the email.
Someone who grabs the users email and password from a breach would also need access to their email.
- Krisor103 8y agoAlso if someone attempts to change an email address linked with an account, an email could be sent asking for confirmation. 2FA is also becoming easier to implement for low level developers with Authy and Google Authenticator offering simple to follow boilerplates and documentation. Validation algorithm that forces a dictionary attack on password before successful registration could also be prudent. Just like SQL injection and query prepare statements, issues are very much known but it's the want and need to act on them. GDPR should start to help this, but management tier individuals who push development time scales are also needing to be 'sold' the importance of this.
- iliis 8y agoNo, please don't. This is arduous for those of us who like a bit of privacy and regularly clear their cookies etc.
- ptaipale 8y agoI guess this isn't typically based on cookies but device/browser fingerprinting.
- iliis 8y agoWhich is exactly what I'm trying to avoid. I don't want to be tracked so I try to limit the amount of fingerprinting possible.
- ptaipale 8y agoBut for this it is probably good that the services do fingerprint us - so that we understand how well it can work. Otherwise we'd assume that cleaning cookies is enough and wouldn't know how well that tracking works, not only when services that we knowingly use are doing it, but also when some actual black hats do it.
- Dylan16807 8y agoWhy not whitelist the cookies of sites where you're going to log right back in?
- jakecopp 8y agoFirefox Containers work great for this!
- packet_nerd 8y agoI second Firefox Containers.. very useful feature.
- iliis 8y agoThat's actually a good idea! It doesn't work for Google or Facebook tough, or other services I explicitely don't log right back in.
- buro9 8y agoWhat I do is similar. I use auth0, and have it configured for passwordless use. If you have a Google Account or Microsoft Account then you can simply use the OIDC / OAuth flow and have those third parties that you trust identify you and handle the authentication... we only ask for an email as it's necessary for our service. Because it's only auth0 talking to the identity provider, Google and Microsoft don't actually get to see which site you're signing into. If you don't have those, then you can just use an email code. We email you a single-use expiring (15 minutes) code, you enter it and gain access. In this scenario email becomes your identity. I use private browsing for everything... this is a bit inconvenient as password managers cannot handle this email verification flow. But for me that's good... I want this level of security for myself, I want the service not to be storing passwords whilst also not permitting identity providers to know what I'm signing into.
- gnud 8y agoJust a side note: Password managers are not useless in private browsing. I use KeePass and Kee for firefox, and it works the same in private browsing as in "normal" browsing.
- giancarlostoro 8y agoThey meant getting a new login password emailed to you.
- buro9 8y agoI had edited to clarify, gnud was right in his reply as my original wasn't as clear.
- homero 8y agoThese people reuse passwords so logging into their email is the same.