4 ms·
I would argue that a magic link system has to only allow the click-through to grant access on the machine that initiated the login flow. If I enter my email in
by philsnow 2y ago
I would argue that a magic link system has to only allow the click-through to grant access on the machine that initiated the login flow.
If I enter my email in SomeSite, they send a magic link to my email address, and then Mallory intercepts that email and gains access to my SomeSite account just by opening the link (i.e. the link acts as a bearer token), that's completely broken.
- stickfigure 2y agoIf someone has access to your email, they can recover passwords to everything. Email is the master key, treat it that way.
- portaouflop 2y agoUse MFA and that is not the case. If email is your master key to everything I would worry.
- stickfigure 2y agoI assure you, most systems - even ones with MFA - can be reset via email.