3 ms·

At the risk of exposing my considerable ignorance, provided this is done over ssl, how is it different from a reset password link or any other information?

kgermino 15y ago
Expiration time, password reset emails are typically one-time-use so it doesn't matter if they're in logs once the user has loaded the page.
- cubicle67 15y ago
  What if the key was tied to the machine it was first used with? That may get confusing for users though
  - true_religion 15y ago
    IP addresses can be spoofed. You'd have to also place a secret code on each page, and reject form data or user requests (e.g. to delete their data, etc.) if the secret code wasn't submitted.
  - owenmarshall 15y ago
    What happens when someone hits your app from a library computer? From behind a proxy? Have you thought about what happens when their IP changes? Stop. You are inventing a crazy homebrew authentication system here. One great way to absolutely fuck your site's security is through crazy homebrew authentication/authorization/cryptography. Do it right, don't do it yourself.
    - sapphirecat 15y ago
      > Have you thought about what happens when their IP changes? ++. When I was walking this road, I answered that question with "I'll use the user-agent instead!" Then I checked that assumption, and the Internet told me that could vary between requests as well. That was the key insight (you can't trust anything) that put me on the road to a much more standard system. (But probably still insecure, since I was younger and working for someone with NIH syndrome.)
  - politician 15y ago
    I previously did some work for an online poker service who had a financial incentive in knowing who was logging in as who and had a custom client with which they could do all sorts of nasty spyware-esque things to the client's machine. And they were still susceptible to hackers. You have a browser for a client and HTTP. Please, don't end up on HN as sadly yet another cautionary tale for doing security wrong.

kgermino 15y ago

Expiration time, password reset emails are typically one-time-use so it doesn't matter if they're in logs once the user has loaded the page.

cubicle67 15y ago
What if the key was tied to the machine it was first used with? That may get confusing for users though
- true_religion 15y ago
  IP addresses can be spoofed. You'd have to also place a secret code on each page, and reject form data or user requests (e.g. to delete their data, etc.) if the secret code wasn't submitted.
- owenmarshall 15y ago
  What happens when someone hits your app from a library computer? From behind a proxy? Have you thought about what happens when their IP changes? Stop. You are inventing a crazy homebrew authentication system here. One great way to absolutely fuck your site's security is through crazy homebrew authentication/authorization/cryptography. Do it right, don't do it yourself.
  - sapphirecat 15y ago
    > Have you thought about what happens when their IP changes? ++. When I was walking this road, I answered that question with "I'll use the user-agent instead!" Then I checked that assumption, and the Internet told me that could vary between requests as well. That was the key insight (you can't trust anything) that put me on the road to a much more standard system. (But probably still insecure, since I was younger and working for someone with NIH syndrome.)
- politician 15y ago
  I previously did some work for an online poker service who had a financial incentive in knowing who was logging in as who and had a custom client with which they could do all sorts of nasty spyware-esque things to the client's machine. And they were still susceptible to hackers. You have a browser for a client and HTTP. Please, don't end up on HN as sadly yet another cautionary tale for doing security wrong.