5 ms·

> However, there is a route on dev that can show email content to CMs and they use this to obtain the magic link used to reset credentials So many sites do thi

> However, there is a route on dev that can show email content to CMs and they use this to obtain the magic link used to reset credentials So many sites do this: allowing major changes to be effective immediately (like resetting credentials/password) by simply opening a "magic link" sent by email. I think that this "immediately" is a major security antipattern. I prefer it when such changes have a "cooldown" period of, say, 72 hours, during which the change is "ongoing" but not effective yet and during which the user can veto the change (say by either login on the site, where they'd then get a warning that a major configuration change is ongoing, and denying the change on the site or by opening another "magic link", sent by email, which allows to deny the change). It's not a perfect solution but it stops so many of these oh-so-common attacks dead in their tracks. Because there's a big difference between being able to read an email meant to someone (as happened here, on the server side) and being able to prevent a legit user from receiving emails while also being able to prevent that legit user from login onto a website with its correct credentials.

NieDzejkob 6y ago
I don't think it's a good idea to make a password reset take 3 entire days. In this case, I'd say the costs outweigh the benefits.
- curiousllama 6y ago
  Yea, 10 minutes & a text message would suffice, IMO...
  - LeifCarrotson 6y ago
    I think the most important part would be to give someone time to vet that it's legitimate. Stack Exchange has on the order of 100 developers, it wouldn't be hard to CC account creation or password reset notices to the manager of a new hire, and in that case, 10 minutes would often be enough to say "Uh, I haven't hired anyone named Curious Llama, who are they and why are they requesting developer access to an obsolete resource?" and put the brakes on.
    - Hjfrf 6y ago
      That might not have helped in this case, if the email was sent from the same account. The hacker had access to messages from the sender side without access to the account being reset.
Sebb767 6y ago
While I partially agree, letting an user deny the password change with the old password is pretty horrible in case the password was leaked. And if your dev forgot the password after the holidays, you're looking at 3 additional free days for him. I see your point, but a timeout is a suboptimal solution.
- TacticalCoder 6y ago
  > ... letting an user deny the password change with the old password is pretty horrible in case the password was leaked. That's a different threat: an attacker knowing your password. Well... How do websites that allow instant credentials resets by email typically deal with a password reset asked by someone who knows the current password? Instant change too ("enter your current password / enter your new password twice"). And the good guy is locked out of his own account. I don't see how it's worse than that.
pc86 6y ago
The next time you forget a password and need to reset it, how likely are you to be willing to wait three days?
- TacticalCoder 6y ago
  > The next time you forget a password and need to reset it, how likely are you to be willing to wait three days? 10 minutes like others suggested is way too short that said: this wouldn't catch attacks happening at night. But to answer your question: it really depends what it is that you are protecting. For most sites I use by very far I don't see how 72 hours without access would be that problematic. Not logged in to StackOverflow for 3 days? Not a problem. Not logged in to HN for 3 days? Not a problem. Not logged in to Twitter for 3 days? I can live with that. Etc. The question is: how much convenience are you willing to trade for security?
- saagarjha 6y ago
  Ten days is better than forever, FWIW, which is something that many websites do.
spelunker 6y ago
I think the problem is showing the "magic link" anywhere other than in the email for the intended recipient, since it's effectively a password. As others have mentioned though, if you as a user know someone has access to said password and you're resetting it as an emergency, that's 3 more days of some hacker being able to log in with your password!

NieDzejkob 6y ago

I don't think it's a good idea to make a password reset take 3 entire days. In this case, I'd say the costs outweigh the benefits.

curiousllama 6y ago
Yea, 10 minutes & a text message would suffice, IMO...
- LeifCarrotson 6y ago
  I think the most important part would be to give someone time to vet that it's legitimate. Stack Exchange has on the order of 100 developers, it wouldn't be hard to CC account creation or password reset notices to the manager of a new hire, and in that case, 10 minutes would often be enough to say "Uh, I haven't hired anyone named Curious Llama, who are they and why are they requesting developer access to an obsolete resource?" and put the brakes on.
  - Hjfrf 6y ago
    That might not have helped in this case, if the email was sent from the same account. The hacker had access to messages from the sender side without access to the account being reset.

Sebb767 6y ago

While I partially agree, letting an user deny the password change with the old password is pretty horrible in case the password was leaked. And if your dev forgot the password after the holidays, you're looking at 3 additional free days for him. I see your point, but a timeout is a suboptimal solution.

TacticalCoder 6y ago
> ... letting an user deny the password change with the old password is pretty horrible in case the password was leaked. That's a different threat: an attacker knowing your password. Well... How do websites that allow instant credentials resets by email typically deal with a password reset asked by someone who knows the current password? Instant change too ("enter your current password / enter your new password twice"). And the good guy is locked out of his own account. I don't see how it's worse than that.

pc86 6y ago

The next time you forget a password and need to reset it, how likely are you to be willing to wait three days?

TacticalCoder 6y ago
> The next time you forget a password and need to reset it, how likely are you to be willing to wait three days? 10 minutes like others suggested is way too short that said: this wouldn't catch attacks happening at night. But to answer your question: it really depends what it is that you are protecting. For most sites I use by very far I don't see how 72 hours without access would be that problematic. Not logged in to StackOverflow for 3 days? Not a problem. Not logged in to HN for 3 days? Not a problem. Not logged in to Twitter for 3 days? I can live with that. Etc. The question is: how much convenience are you willing to trade for security?
saagarjha 6y ago
Ten days is better than forever, FWIW, which is something that many websites do.

spelunker 6y ago

I think the problem is showing the "magic link" anywhere other than in the email for the intended recipient, since it's effectively a password. As others have mentioned though, if you as a user know someone has access to said password and you're resetting it as an emergency, that's 3 more days of some hacker being able to log in with your password!