3 ms·

> But that's hardly a reason to say that logging into a website with a password or presenting a cookie doesn't count as an authentication system! That's fine.

> But that's hardly a reason to say that logging into a website with a password or presenting a cookie doesn't count as an authentication system! That's fine. No one is saying that. They're saying that URLs aren't an authentication (or authorization) system.

Silhouette 5y ago
They're saying that URLs aren't an authentication (or authorization) system. I'm curious to know how those advocating a position similar to this think something like a password reset facility on a website should work. We all know security-sensitive systems should rely on alternative methods of authentication anyway, but for those of us living in the real world where billions of people access millions of systems via websites using their email address as ID/fallback, what else would you do that does not rely on trusting emails to be acceptably secret for at least a few minutes?
- pwdisswordfish0 5y ago
  What relation does your question have to the statement you're quoting?
  - geofft 5y ago
    As a wise person once said, playing dumb isn't clever, it's just obnoxious.
    - pwdisswordfish0 5y ago
      You seem to have difficulty following the logical throughline here. There is no playing dumb in the previous comment. Let's put it in a statement instead of the form of a question: it does not follow to respond to the quoted part ("URLs aren't an authentication (or authorization) system") with remarks about "those of us living in the real world where billions of people access millions of systems via websites using their email address as ID/fallback[...]". You (both of you) are confusing the subject here: URLs vs reaching back to drag emails and their privacy into focus. They're different fucking things! Stop responding to comments about one with responses that deal in the other! Billions of people access websites using their email addresses? Granted! Now say something about URLs if that's what your quibble is and shut up about the emails that the URLs were sent in and whether or not those emails are private. The comments about email are misdirection at worst, and a sign of unclear thinking (and a hazard to confuse others) at best.
geofft 5y ago
I agree no one is saying that. I think they are being unsound in refusing to say that but also saying that URLs don't count as an authentication system. Is the argument "Information in an email should be treated as public"? Then how do you validate users on signup in the first place? How do you ensure that someone owns an email address that they claim to own? Is the argument "Information sent over HTTPS should be treated as public"? Then why does the argument not apply to passwords or cookies? If the argument is something else, what is it?
- pwdisswordfish0 5y ago
  "Is the argument [...]? Is the argument [...]? If the argument is something else, what is it?" This not difficult at all. Playing dumb isn't clever, it's just obnoxious. The argument, stated amply before, is that URLs are not private. Email being a private medium or not is orthogonal.

Silhouette 5y ago

They're saying that URLs aren't an authentication (or authorization) system. I'm curious to know how those advocating a position similar to this think something like a password reset facility on a website should work. We all know security-sensitive systems should rely on alternative methods of authentication anyway, but for those of us living in the real world where billions of people access millions of systems via websites using their email address as ID/fallback, what else would you do that does not rely on trusting emails to be acceptably secret for at least a few minutes?

pwdisswordfish0 5y ago
What relation does your question have to the statement you're quoting?
- geofft 5y ago
  As a wise person once said, playing dumb isn't clever, it's just obnoxious.
  - pwdisswordfish0 5y ago
    You seem to have difficulty following the logical throughline here. There is no playing dumb in the previous comment. Let's put it in a statement instead of the form of a question: it does not follow to respond to the quoted part ("URLs aren't an authentication (or authorization) system") with remarks about "those of us living in the real world where billions of people access millions of systems via websites using their email address as ID/fallback[...]". You (both of you) are confusing the subject here: URLs vs reaching back to drag emails and their privacy into focus. They're different fucking things! Stop responding to comments about one with responses that deal in the other! Billions of people access websites using their email addresses? Granted! Now say something about URLs if that's what your quibble is and shut up about the emails that the URLs were sent in and whether or not those emails are private. The comments about email are misdirection at worst, and a sign of unclear thinking (and a hazard to confuse others) at best.

geofft 5y ago

I agree no one is saying that. I think they are being unsound in refusing to say that but also saying that URLs don't count as an authentication system. Is the argument "Information in an email should be treated as public"? Then how do you validate users on signup in the first place? How do you ensure that someone owns an email address that they claim to own? Is the argument "Information sent over HTTPS should be treated as public"? Then why does the argument not apply to passwords or cookies? If the argument is something else, what is it?

pwdisswordfish0 5y ago
"Is the argument [...]? Is the argument [...]? If the argument is something else, what is it?" This not difficult at all. Playing dumb isn't clever, it's just obnoxious. The argument, stated amply before, is that URLs are not private. Email being a private medium or not is orthogonal.