4 ms·
It definitely does not. Have your logging-in session wait for / poll "has visited magic link", and authenticate that session when it's done. Tons of systems d
by Groxx 2y ago
It definitely does not.
Have your logging-in session wait for / poll "has visited magic link", and authenticate that session when it's done.
Tons of systems do this. It works great, and it can quite easily work without any web browser at all on the logging-in side because it just needs to curl something -> poll for completion and save the cookies -> curl against the API. A number of oauth flows for e.g. TVs work this way, for instance, because it's a heck of a lot easier than integrating a full browser in the [embedded thing]. Many app-based 2FA (e.g. Duo) works this way too.
- renewiltord 2y agoSo I misclick a link in my email client and the evil guy who requested in is now logged in on his browser god knows where? Surely that can’t be real. It sounds awful. TVs involve copying a code to make sure the right device is being authenticated, or the ones I’ve used have at least.
- Groxx 2y agoDuo 2FA works the same way. In principle yes. And it's basically always accompanied by a "click this link" -> "are you trying to log in, and is this you? yes/no" page to resist that. Small code copying is also a very good answer though, yes. Roughly as easily manipulated, but nothing's perfect, and it's less "I didn't mean to click that button"-prone.
- renewiltord 2y agoYeah but I routinely click links in emails whereas logging in is the sole purpose of Duo. I could easily just intend to scroll the page and end up tapping the link.
- Groxx 2y agoso have that open a site that says "confirm login? y/n". I don't mean to imply that just visiting the link should be enough to complete a login. That's a GET and there's a LOT of issues with doing anything important on GET. Just "do something on a different machine, then automatically complete login on the one logging in", and magic links to trigger that flow are a rather straightforward option. There's no reason at all that it has to all occur on the same machine, and many reasons why attempting to require that doesn't work out in practice even when it does happen on the same machine.
- renewiltord 2y agoAh I see. Yes, that makes sense.
- paxys 2y agoNo "tons" of systems do not do this. If you come across one that does it was built by a team that has no idea about security. TVs etc. are special cases because obviously there is no way to redirect to them, and even there developers will always have some kind of secondary checks like having you enter a code displayed on the screen.
- edoceo 2y agoWhen I sign on to a bank it sends an SMS. Then my phone prompts me to share that code with the brower, on my desktop. It's a neat QOL "feature" - but kinda feels too automated to be secure.
- lupire 2y agoThat's because the server recognizes both clients, and you are prompted to approve the other client from the client that has the code. You are giving permission to the remote client, not taking permission from the remote client.
- edoceo 2y agoThe server recognized my device from the messenger/SMS app? That seems not correct. But somehow, the desktop browser and my mobile are tied together for this app. But no other sites have this magic.
- happyopossum 2y agoIf you have an iPhone and a mac, most sites that use SMS OTPs work this way
- edoceo 2y agoLinux desktop, android phone.
- Groxx 2y ago
- sunnybeetroot 2y agoThis seems dangerous: 1. Attacker starts a log in and triggers a magic link email 2. Email received and my browser client previews the link without my desire 3. Attacker is now logged in
- codetrotter 2y agoThat’s why you combine it with a check for source IP and tell your user that they need to approve from a device that has same IP as the one they are logging in on. So if I’m logging in on my laptop, and approving with my phone, it will be rejected if my phone is using mobile data while my laptop is using landline, but will approve if my phone is connected to WiFi of the same network my laptop is connected to, or if my laptop is tethered via my phone, because then I have same external source IP on both devices.
- witrak 2y agoThis scenario is a solution only in simplest cases. It doesn't work when someone routinely uses a VPN on the phone (when often uses free public wi-fi in airports, railway stations, markets etc) because of possible MITM attacks.
- asddubs 2y agoalso some ISPs will give you a different IP every request
- apitman 2y agoThis has security and usability issues. NAT/CGNAT means a potentially large number of people can hijack your login.
- radlad 2y agoThe links are one-time use so you need to take this into account anyway or users simply can't login. It's usually done with a required button click after following the magic link. Or you can try JavaScript techniques to detect a real browser.