4 ms·

Tangential, but are magic links safe for all purposes? Slack mails you a link that logs you in. It seems as safe as services that use password reset or oauth.

pspeter3 7y ago
That is my intuition as well. It also seems better than password. Fire base offers it as an option.
jammygit 7y ago
You get a degree of cryptographic security by using a sufficiently large and random token - ie, attackers computers cannot spam guesses fast enough to get a hit in any reasonable amount of time. I can’t remember what the exact requirements are though.
WorldMaker 7y ago
One Time Password (OTP) via email is at least as secure as any service that provides password reset as degenerate cases of those services resembles OTP via email anyway. (There are a lot of users out there using such a degenerate case already today. It's amazing how many users have fallen into a "reset password only" workflow to login to things.) Magic links that embed the OTP inside of a clickable URL have a couple added threat scenarios, mostly revolving around the tenuous connection between app launching URL custom schema and OS/App Store/User Permissions. In some, but not all cases, OS/App Stores make it hard or unlikely for a third party to intercept those URLs, but not always impossible. There's no real central registry for the custom schema between App Stores, for one example. The successor to custom schemas "Universal Links" (pushed by PWA standards among other things) have an interesting mitigation in requiring the links to be HTTPS, with TLS-verifiable metadata that promises that link is to a domain that the App author clearly controls before passing things on to the App. It's not a perfect mitigation, but a useful one as part of a larger defense in depth, depending on your application/site's threat model.

4 ms·

Tangential, but are magic links safe for all purposes? Slack mails you a link that logs you in. It seems as safe as services that use password reset or oauth.

by aitchnyu 7y ago

pspeter3 7y ago
That is my intuition as well. It also seems better than password. Fire base offers it as an option.
jammygit 7y ago
You get a degree of cryptographic security by using a sufficiently large and random token - ie, attackers computers cannot spam guesses fast enough to get a hit in any reasonable amount of time. I can’t remember what the exact requirements are though.
WorldMaker 7y ago
One Time Password (OTP) via email is at least as secure as any service that provides password reset as degenerate cases of those services resembles OTP via email anyway. (There are a lot of users out there using such a degenerate case already today. It's amazing how many users have fallen into a "reset password only" workflow to login to things.) Magic links that embed the OTP inside of a clickable URL have a couple added threat scenarios, mostly revolving around the tenuous connection between app launching URL custom schema and OS/App Store/User Permissions. In some, but not all cases, OS/App Stores make it hard or unlikely for a third party to intercept those URLs, but not always impossible. There's no real central registry for the custom schema between App Stores, for one example. The successor to custom schemas "Universal Links" (pushed by PWA standards among other things) have an interesting mitigation in requiring the links to be HTTPS, with TLS-verifiable metadata that promises that link is to a domain that the App author clearly controls before passing things on to the App. It's not a perfect mitigation, but a useful one as part of a larger defense in depth, depending on your application/site's threat model.