3 ms·
I wrote a library for Rails a few weeks ago at https://github.com/rocketshipio/nopassword https://github.com/rocketshipio/nopassword that eliminates passwords f
by bradgessler 4y ago
I wrote a library for Rails a few weeks ago at https://github.com/rocketshipio/nopassword https://github.com/rocketshipio/nopassword that eliminates passwords for login by making folks login with an email address and then emailing them a code.
It eliminates the vulnerability this article speaks of and eliminates passwords, along with all the support headaches that comes with.
- WA 4y agoOnly if existing sessions are invalidated. Otherwise, magic login links like this have a problem: - Attacker signs up with victim's email address and is immediately logged in (signup usually triggers a login/session creation). The session could last forever - Victim tries to sign up, but it doesn't work, because the account is already registered. Victim assumes they forgot about them signing up already and requests a login-link/token. Victim logs in using the method and adds sensitive data to the account. - Attacker session is still active, attacker can read victim's information.
- bradgessler 4y agoAttacker can’t sign in with victims email unless they have gained access to victims email account. No session gets created for the authorized user until they provide a valid code and salt (within 3 tries and 5 min).