3 ms·
Also a possible way for magic links to be secure even if email is compromised is for the requesting browser to create a secret client side so that only that bro
by nnx 4y ago
Also a possible way for magic links to be secure even if email is compromised is for the requesting browser to create a secret client side so that only that browser can actually proceed with the magic link.
- joosters 4y agoIf the email is compromised, the hacker can just go to the front page in their own browser and generate a fresh login email, so there's no extra protection in client-side browser secrets.
- xxs 4y agoIt'd be ok, if there is (yet) another factor for doing this, e.g. SMS, time based tokens, and you'd need 2 of them to reset the 3rd. Cumbersome to put it mildly.