4 ms·

It is common for corporate email security appliances as well. URLs should not be used for authentication neither should email. I really want to pick brains of p

by _8j50 4y ago

It is common for corporate email security appliances as well. URLs should not be used for authentication neither should email. I really want to pick brains of people that work on these types of systems to see why they don't think so.

rsbadger 4y ago
Many people (most?) prefer to signup to services by email address. To do so, those email addresses must be verified. How would you verify it without sending them an email link?
- throwaway14356 4y ago
  a confirmation code? Also, mail might not live on the same computer.
  - xboxnolifes 4y ago
    It doesn't matter if it's on the same computer. Sometimes all you need to do is click the link, not do anything on the page.
- _8j50 4y ago
  You can verify validity of an email like that, no issue there. Just don't use that as a factor authentication. Control over an email account should not trump passwords (what you know) or proper 2fa (what you have, typically, email can be 2fa like sms and like sms it is not a good choice). If a person proves they control an email account then you ask them for additional info like secret questions or other information configured during registration. I should not be able to take over your life because I compromised your phone which has sms, TOTP app and email.
- inopinatus 4y ago
  options include: * use an interstitial page so that the actual activation is a POST request; * send a confirmation code instead of a link
postalrat 4y ago
Is it ok to do a password reset through email? Because once you can do that you basically have email based authentication. The password only makes this autentication less secure and it's not needed.
- _8j50 4y ago
  It is not. You can initiate password reser via email but additional recovery controls like security questions should still be required. In an ideal world you have 2fa as well, if you reset that via email as well the it isn't actually 2fa, it is email based 1fa with extra steps. If your 2fa has a separate mechanism for recovery as well,that would be ideal. If it was my webapp, I would use hashes of 3 answers to user chosen questions, hashes in the browser/client. It could be an object pairing as well, every user gets a list of 30 objects or so and they pick 3 pairs as a recovery combination.
  - postalrat 4y ago
    Hashing an answer to many questions isn't prevent someone from guessing the input until the hashes match. So why bother hashing? Recovery codes exist and are created at the time before recovery is necessary. But most people are going to lose their codes. Who is going to remember what 3 things they picked out of 30 years ago?

by _8j50 4y ago

rsbadger 4y ago

Many people (most?) prefer to signup to services by email address. To do so, those email addresses must be verified. How would you verify it without sending them an email link?

throwaway14356 4y ago
a confirmation code? Also, mail might not live on the same computer.
- xboxnolifes 4y ago
  It doesn't matter if it's on the same computer. Sometimes all you need to do is click the link, not do anything on the page.
_8j50 4y ago
You can verify validity of an email like that, no issue there. Just don't use that as a factor authentication. Control over an email account should not trump passwords (what you know) or proper 2fa (what you have, typically, email can be 2fa like sms and like sms it is not a good choice). If a person proves they control an email account then you ask them for additional info like secret questions or other information configured during registration. I should not be able to take over your life because I compromised your phone which has sms, TOTP app and email.
inopinatus 4y ago
options include: * use an interstitial page so that the actual activation is a POST request; * send a confirmation code instead of a link

postalrat 4y ago

Is it ok to do a password reset through email? Because once you can do that you basically have email based authentication. The password only makes this autentication less secure and it's not needed.

_8j50 4y ago
It is not. You can initiate password reser via email but additional recovery controls like security questions should still be required. In an ideal world you have 2fa as well, if you reset that via email as well the it isn't actually 2fa, it is email based 1fa with extra steps. If your 2fa has a separate mechanism for recovery as well,that would be ideal. If it was my webapp, I would use hashes of 3 answers to user chosen questions, hashes in the browser/client. It could be an object pairing as well, every user gets a list of 30 objects or so and they pick 3 pairs as a recovery combination.
- postalrat 4y ago
  Hashing an answer to many questions isn't prevent someone from guessing the input until the hashes match. So why bother hashing? Recovery codes exist and are created at the time before recovery is necessary. But most people are going to lose their codes. Who is going to remember what 3 things they picked out of 30 years ago?