5 ms·
The reason so many sites prompt for password is for security. Yes, they will also send you an email with a link to reset the password to the same address. How
by mdasen 15y ago
The reason so many sites prompt for password is for security. Yes, they will also send you an email with a link to reset the password to the same address. However, the difference there is that you will know if someone has changed your Foursquare password and the token used to allow for a password change can be expired immediately after the change takes place rather than offering continued access.
With the OKCupid system, someone that has access to my email (even for a short time) might get continued access to my OKCupid account. I won't know that they have access. With Foursquare, someone who has access to my email can get access to my Foursquare by using the forgot password system. However, when they reset my password, I won't know the new password and there's a decent likelihood that I will realize that someone has broken into my account.
With the forgot password system, it's easy to expire that token as soon as the password is changed. With the instant login system, you can't expire the token after its first use since the email will still be in the user's inbox where they expect it to work. In one case, there will be a URL in my history with the token and if someone is smart, they can just try typing in okcupid.com/l in my browser and wait for the autocomplete with an auto-login token from my history. With the forgot password system, it will be in my history, but it will have expired when I changed my password. So, even if I've signed out of my email and okcupid before letting a friend borrow my computer, there will still be an auto-login token in my browser history that can be exploited.
I'm not saying that there aren't low-security services where this convenience is good. It's more that the author hasn't taken into account that there is greater security in the forgot password system.
- itcmcgrath 15y agoNot to also forget that if you have automagic login links in the email, you can no longer forward that email to anyone without compromising your account. Try educating end-users on that one!
- danenania 15y agoYep, this alone is a borderline fatal flaw. The practice of sharing links, whether done intentionally or unintentionally through email forwarding, is pervasive and people won't stop to think about whether the url contains an embedded login token. This practice opens up a new class of vulnerabilities in the human error realm. Now there could of course be ways around this like time/ip/geo pattern tracking, but that's no trivial enterprise.
- itcmcgrath 15y agoAnd not without their own set of flaws either.
- JoachimSchipper 15y agoSimple solution: put a persistent cookie on the computer of everyone who's ever logged in. Automatically log the user in if this cookie is present and the URL is correct. Obviously, the cookie should be unforgeable - e.g. HMAC-SHA1(service_secret_key, username).
- thirsteh 15y agoThis is the best approach to the problem, though it doesn't satisfy the implied(?) requirement that new devices should auto-authenticate seamlessly. You have to keep track of all of the cookies, of course, but there is comparatively little risk in letting previously authenticated machines (with an expired session) perform automatic login via a token in an email. The OP should point this out in his article.
- deno 15y agoThe only situation you're targeting, then, is when a user intentionally logged out (in non-privacy mode) in the past (because otherwise they wouldn't have the half-cookie). Is it really desirable to log in them automatically in such cases? But then if they're clicking on the link in the first place, one might conclude that they desire is to log-in, so it's just added convenience. However is it legal under the new EU cookie-act? I mean, after all, this is tracking outside of our website.
- JoachimSchipper 15y agoLots of people "log out" by letting their session expire; this would merely get them back in the game faster. I'd expect this to be legal - set the cookie on login.mydomain.com and never use that domain name for anything else - but IANAL.
- deno 15y ago> Lots of people "log out" by letting their session expire; this would merely get them back in the game faster. I'd expect, that someone that is going to employ auto-login URLs, is not going to be shy in using ‘forever’ login cookies anyway.
- sneak 15y ago> With the instant login system, you can't expire the token after its first use since the email will still be in the user's inbox where they expect it to work. As the article mentions, you can expire them after a week or so. And if you're smart enough to do this, you're smart enough to fall back gracefully to the old "login form" behavior when you get a link with an expired token.
- cdcarter 15y agoHell, you could expire them as soon as they are clicked, and then have the fallback.
- LokiSnake 15y agoAn immediate expiry would not solve the initial problem. A user can easily click on the link on an iPhone, then want to read the content on his desktop. A timed expiry would work much better.
- lamby 15y agoAnother trick is to mix in the user's hashed password when you generate and check the HMAC - that way if the user ever changes their password all the previous links fail to work.
- sssparkkk 15y ago> I'm not saying that there aren't low-security services where this convenience is good. It's more that the author hasn't taken into account that there is greater security in the forgot password system. Exactly. And I think it's somewhat dangerous for the author of the article to not understand this important distinction and at the same time advise creators of web apps to implement this behavior. Judging by the amount of upvotes for the article and the comments it has been getting, I'm afraid some of us will simply follow his advice and replace reset password emails with direct login links.
- scoot 15y agoIt's getting upvotes because the title says "don't do this". People are voting for the fact that the article is offers bad advice. The author however doesn't seem to have quite grasped this - thanking us for his position on the HN front page!
- trotsky 15y agoNo, the main article has the same title. The author seems to mean: "don't make me log in after I click on an email!". It is clearly bad advice but HN often seems to vote on confidence of delivery.
- skrish 15y agoI upvoted it for the value of discussion in the thread than for the article itself. :)
- pbreit 15y ago> The reason so many sites prompt for password is for security I doubt it. I think the reason has more to do with what their framework or authentication scheme supports or how rigorous they are with user engagement.