5 ms·
Sorry, but "Automatic login links are no less secure" is an extremely flawed statement. Automatic login links have the same issues, but them some more. Please
by itcmcgrath 15y ago
Sorry, but "Automatic login links are no less secure" is an extremely flawed statement.
Automatic login links have the same issues, but them some more.
Please remember people WILL forward emails. This means that people WILL have unauthorised access to your system.
If you are implementing the system as you have described, you are being negligent to your users. You are also setting yourself up to be the next Sony.
- itcmcgrath 15y agoIf you really want to do something like this, PLEASE implement some form of out of band 2FA. For example, SMS a PIN to a mobile number once the link has been clicked. This gives the benefit of not needing to remember your password, but requiring more than just a forwarded email to sign in.