3 ms·
E-Mails are unencrypted and can be intercepted. When speaking of E-Mail as a user authentication method, it's just as unsecure as SMS. I'd heavily disrecommen
by cookiengineer 5y ago
E-Mails are unencrypted and can be intercepted.
When speaking of E-Mail as a user authentication method, it's just as unsecure as SMS.
I'd heavily disrecommend the author's method of sending 2FA codes unencrypted through the internet.
While it is an unlikely attack surface for private hackers, it is a very likely attack scenario of state level actors.
Also: gpg as encryption isn't worth anything when everybody has your public key and/or sent it before via an unencrypted transport layer.
- Galanwe 5y ago> E-Mails are unencrypted and can be intercepted Hu, yes they are. I don't think there's still non ssl mail transport nowadays. > gpg as encryption isn't worth anything when everybody has your public key and/or sent it before via an unencrypted transport layer. Interesting how a grammatically correct English sentence can have 0 meaning.
- dane-pgp 5y ago> I don't think there's still non ssl mail transport nowadays. You might be off by 10%, unfortunately, but let's hope that 10% is just spam or other non-sensitive data. https://transparencyreport.google.com/safer-email/overview https://transparencyreport.google.com/safer-email/overview
- sriku 5y agoI use a similar technique to this author's on my site (for about 5 years now) but it is a variant where even if someone got the email or you forward it accidentally to someone, they won't be able to use it to login. Technique described here - http://sriku.org/blog/2017/04/29/forget-password/ http://sriku.org/blog/2017/04/29/forget-password/ ... basically when use provides email to signin, a cookie stores a part of the token while the server send the other part via email. Both parts need to be put together and validated for a login to get through. So the link sent in the email will work only in the browser session where the cookie stored at login time is accessible ... which is how it is configured for most of the users of my small site. Another side effect of this technique is that bad login attempts do not need a database hit to be rejected.
- Moru 5y agoWhat happens with people using the phone for email but a computer for work?
- ec109685 5y agoYou can adjust this by simply requiring user to type a code from their email. That said, if an attacker had persistent access to your email, you’d still be compromised through this method.
- sriku 5y agoNot necessarily. The code could be a part of what's combined with the cookie for the login. And the site could trash the cookie if tried once with an invalid code just as it would replace it with an auth cookie on success. A real attack would be through a programmatic request though. A captcha might help protect from that or you an use a redis instance or whatever to invalidate bad login cookies.
- Moru 5y agoOr you could just use normal generated passwords that are synced between devices in your firefox and never have to bother again with logging in on any device.
- dodgerdan 5y agoA 6 digit code is ok for 2FA. It’s not good enough for single factor auth like this. There’s not enough entropy & it could be brute forced.
- ec109685 5y agoGood point. Adding letters would be key.
- matthewfcarlson 5y agoThis is fantastic, I might steal this technique since it's so good.
- stavros 5y ago> Also: gpg as encryption isn't worth anything when everybody has your public key and/or sent it before via an unencrypted transport layer. I think you need to read more about how asymmetric cryptography works.
- deleted 5y ago[deleted]
- ec109685 5y agoEven with passwords, e-mail is a likely password reset flow. If that’s the case, using a password only reduces security.
- dodgerdan 5y agoIf emails can be intercepted most password based sites with an email based Forgot Password flow are vulnerable.