5 ms·
I use a similar technique to this author's on my site (for about 5 years now) but it is a variant where even if someone got the email or you forward it accident
by sriku 5y ago
I use a similar technique to this author's on my site (for about 5 years now) but it is a variant where even if someone got the email or you forward it accidentally to someone, they won't be able to use it to login.
Technique described here -
http://sriku.org/blog/2017/04/29/forget-password/ http://sriku.org/blog/2017/04/29/forget-password/
... basically when use provides email to signin, a cookie stores a part of the token while the server send the other part via email. Both parts need to be put together and validated for a login to get through. So the link sent in the email will work only in the browser session where the cookie stored at login time is accessible ... which is how it is configured for most of the users of my small site.
Another side effect of this technique is that bad login attempts do not need a database hit to be rejected.
- Moru 5y agoWhat happens with people using the phone for email but a computer for work?
- ec109685 5y agoYou can adjust this by simply requiring user to type a code from their email. That said, if an attacker had persistent access to your email, you’d still be compromised through this method.
- sriku 5y agoNot necessarily. The code could be a part of what's combined with the cookie for the login. And the site could trash the cookie if tried once with an invalid code just as it would replace it with an auth cookie on success. A real attack would be through a programmatic request though. A captcha might help protect from that or you an use a redis instance or whatever to invalidate bad login cookies.
- Moru 5y agoOr you could just use normal generated passwords that are synced between devices in your firefox and never have to bother again with logging in on any device.
- dodgerdan 5y agoA 6 digit code is ok for 2FA. It’s not good enough for single factor auth like this. There’s not enough entropy & it could be brute forced.
- ec109685 5y agoGood point. Adding letters would be key.
- matthewfcarlson 5y agoThis is fantastic, I might steal this technique since it's so good.