4 ms·
I've spent some time playing around with it and it seems like this particular implementation is unsafe. Scenario: 1. I enter my email address on the sign in s
by rsweeney21 7y ago
I've spent some time playing around with it and it seems like this particular implementation is unsafe.
Scenario:
1. I enter my email address on the sign in screen on Fast.co in Tab A.
2. I get an email with a "Login" button in it in Tab B.
3. I click the "Login" button and it opens Tab C and tells me I'm now logged in in Tab A.
4. I go back to Tab A and I'm logged in.
Here's the problem: A hacker sitting next to me see's me type my email in to Fast.co or some site that uses Fast login. They type my email in too. I get two emails with Login buttons. How do I know which one logs me in and which one logs in the hacker? If I click the wrong one, the hacker gets a cookie on their machine that gives them access to my account for 30 days.
- ryanwaggoner 7y agoHopefully the link has to be opened on the browser that initiated the original login request.
- rsweeney21 7y agoIt does not. I was able to start the login process on my desktop, click "Login" in the email sent to my phone, and it logged me in on my desktop.
- shrew 7y agoJust tried the same and then entered my email again from another browser shortly after, as you suggested. The first sign in link expired but if your email client displays threaded messages you could very easily click the second and think nothing of it. That would allow the attacker in straight away, while also allowing your original browser in with a bit of faff. There's an active session list, but presumably most users wouldn't be looking at that. Certainly made me more sceptical as I was otherwise quite interested!
- miccah 7y agoPerhaps an identifier can be used so the user can quickly verify the email matches the page. It could be something like a sequence of 3 emojis because matching numbers is hard.