3 ms·
>Your login attempt would keep the login (not logged-in) session open wherever you attempted to login from While I generally agree that this behavior is correc
by RulerOf 4y ago
>Your login attempt would keep the login (not logged-in) session open wherever you attempted to login from
While I generally agree that this behavior is correct from a usability standpoint, it's not safe. That design allows a user to do a one-click account compromise when they receive a magic link that was sent in response to the login attempt of an attacker that happened to know the user's email address.
- silversmith 4y agoSo add a step that requires "knowledge transfer" between the login device and confirmation device. Microsoft does this in their authenticator app showing essentially three confirmation buttons with different numbers on them, and requiring you to press the one being shown on the login screen. Worst case you now have one-in-three-clicks account compromise rater than one-click. And hopefully this also causes the user to ask why they are being required to log in if the app is not displaying the confirmation data.