28 ms·
What happens with people using the phone for email but a computer for work?
by Moru 5y ago
What happens with people using the phone for email but a computer for work?
- ec109685 5y agoYou can adjust this by simply requiring user to type a code from their email. That said, if an attacker had persistent access to your email, you’d still be compromised through this method.
- sriku 5y agoNot necessarily. The code could be a part of what's combined with the cookie for the login. And the site could trash the cookie if tried once with an invalid code just as it would replace it with an auth cookie on success. A real attack would be through a programmatic request though. A captcha might help protect from that or you an use a redis instance or whatever to invalidate bad login cookies.
- Moru 5y agoOr you could just use normal generated passwords that are synced between devices in your firefox and never have to bother again with logging in on any device.
- dodgerdan 5y agoA 6 digit code is ok for 2FA. It’s not good enough for single factor auth like this. There’s not enough entropy & it could be brute forced.
- ec109685 5y agoGood point. Adding letters would be key.