4 ms·

Does any website/app require a password? If your email is compromised, the attacker can request a password reset, then log in that way. Why isn’t it common to

Does any website/app require a password? If your email is compromised, the attacker can request a password reset, then log in that way. Why isn’t it common to use “login emails” with a one time token login buttons in the email? The only downside I see is that it is harder to log in on a machine where you do not want to access your emails; for example like this: On the machine with no email access the site would have to show a qr code, and a phone where you are already logged in would have to scan it, to approve the login. Is this any less secure, or is it just not feasible for average users to understand? What am I missing?

GordonS 6y ago
> If your email is compromised, the attacker can request a password reset, then log in that way. Doesn't this answer your own question? (ideally email password reset should also require MFA) As another, non-security point, occasionally it can take a good few minutes for emails to arrive in your inbox. Though to be fair, that's sometimes the case for SMS too.
- faeyanpiraat 6y ago
  I dont see how it would answer my question. If you can log in with a password, you have 1 way to get hacked (lose the pw). If you can also log in through a pass reset, then you have 2 ways to get hacked. MFA helps, but if I remember correctly Troy shared disappointing statistics about it’s usage by the general public.
mleonhard 6y ago
I asked this exact question some years ago. I believe the answer has many parts: Effective security is tailored to the situation: the app, the users, and the adversaries. Login emails are slow and require multiple steps. The user must enter their email into the website, switch to their email client, wait for the email, open it, and click the link. If the user's email goes down, they cannot log in to the website. Some folks get distracted while waiting for the email. Sometimes a login email will get marked as spam. Sometimes a user permanently loses access to their email account. These things reduce user engagement and increase support costs, and the company makes less money. There are many ways for attackers to obtain email: DNS, BGP, email server, email server backups, user device backups, malware, re-used passwords, and phishing. There are only a handful of ways for an attacker to obtain passwords: malware, password re-use, and phishing. Notice that this is a subset of the attacks on email. And passwords have special mitigations. Some devices have password managers that resist malware. Security teams have various options for reducing password re-use. Good authentication depends on something you know (password) and something you have. Password managers turn something you know (password) into something you have (device). Criminals rarely steal devices to gain access to online accounts. So in practice, something you have is just as good as something you know.
- faeyanpiraat 6y ago
  I get the part where you list the possible inconveniences of email. What I dont get is how having smaller attack surface for losing a password, and using a secure password manager mitigates the attack vector of getting access to my account with a password reset through my compromised email. If I understand correctly you say that email is more vulnerable, so this only strenghtens my point I guess?
  - mleonhard 6y ago
    Password reset is a rare event, so it has extra mitigations: 1. Extra security checks. For example, if you buy a new laptop and use a coffee shop's wifi try to reset your bank password, they will lock your account. You will have to call and talk to a person and give extra personal information to get it unlocked. 2. Notify the user about the password reset. Use email, text, phone call, and postal mail. 3. Automatically lock the account if suspicious activity occurs in a time period after password reset. Examples: - Orders over $100 shipped to new addresses. - Risky transactions: buying gift cards, buying plane tickets in foreign countries, changing the delivery address of a shipment. - Using a known device (with cookies/fingerprint) and the old password. 4. Require extra confirmation for transactions. Examples: re-enter credit card numbers, security codes, and personal id numbers (SSN in USA). 5. Preserve user data so it can be restored to the state before the password reset. These mitigations work well enough for protecting accounts from fraudulent password resets.
    - faeyanpiraat 6y ago
      Thanks, this was the missing puzzle piece.

GordonS 6y ago

> If your email is compromised, the attacker can request a password reset, then log in that way. Doesn't this answer your own question? (ideally email password reset should also require MFA) As another, non-security point, occasionally it can take a good few minutes for emails to arrive in your inbox. Though to be fair, that's sometimes the case for SMS too.

faeyanpiraat 6y ago
I dont see how it would answer my question. If you can log in with a password, you have 1 way to get hacked (lose the pw). If you can also log in through a pass reset, then you have 2 ways to get hacked. MFA helps, but if I remember correctly Troy shared disappointing statistics about it’s usage by the general public.

mleonhard 6y ago

I asked this exact question some years ago. I believe the answer has many parts: Effective security is tailored to the situation: the app, the users, and the adversaries. Login emails are slow and require multiple steps. The user must enter their email into the website, switch to their email client, wait for the email, open it, and click the link. If the user's email goes down, they cannot log in to the website. Some folks get distracted while waiting for the email. Sometimes a login email will get marked as spam. Sometimes a user permanently loses access to their email account. These things reduce user engagement and increase support costs, and the company makes less money. There are many ways for attackers to obtain email: DNS, BGP, email server, email server backups, user device backups, malware, re-used passwords, and phishing. There are only a handful of ways for an attacker to obtain passwords: malware, password re-use, and phishing. Notice that this is a subset of the attacks on email. And passwords have special mitigations. Some devices have password managers that resist malware. Security teams have various options for reducing password re-use. Good authentication depends on something you know (password) and something you have. Password managers turn something you know (password) into something you have (device). Criminals rarely steal devices to gain access to online accounts. So in practice, something you have is just as good as something you know.

faeyanpiraat 6y ago
I get the part where you list the possible inconveniences of email. What I dont get is how having smaller attack surface for losing a password, and using a secure password manager mitigates the attack vector of getting access to my account with a password reset through my compromised email. If I understand correctly you say that email is more vulnerable, so this only strenghtens my point I guess?
- mleonhard 6y ago
  Password reset is a rare event, so it has extra mitigations: 1. Extra security checks. For example, if you buy a new laptop and use a coffee shop's wifi try to reset your bank password, they will lock your account. You will have to call and talk to a person and give extra personal information to get it unlocked. 2. Notify the user about the password reset. Use email, text, phone call, and postal mail. 3. Automatically lock the account if suspicious activity occurs in a time period after password reset. Examples: - Orders over $100 shipped to new addresses. - Risky transactions: buying gift cards, buying plane tickets in foreign countries, changing the delivery address of a shipment. - Using a known device (with cookies/fingerprint) and the old password. 4. Require extra confirmation for transactions. Examples: re-enter credit card numbers, security codes, and personal id numbers (SSN in USA). 5. Preserve user data so it can be restored to the state before the password reset. These mitigations work well enough for protecting accounts from fraudulent password resets.
  - faeyanpiraat 6y ago
    Thanks, this was the missing puzzle piece.