5 ms·

Yes, I clear cookies every time I close my browser, as a layered approach to privacy on top of uBlock Origin and NoScript. There isn't a great way to exclude c

by dpifke 2y ago

Yes, I clear cookies every time I close my browser, as a layered approach to privacy on top of uBlock Origin and NoScript. There isn't a great way to exclude certain sites from this, other than setting up a dedicated web browser in a container just for Mercury. I wasn't aware that WebAuthn didn't have this requirement. I prefer TOTP because I actually like having a second factor in addition to a credential stored on my computer's hard drive (whether a password or a private key in my password manager), but I might be willing to reduce my security posture to get rid of this annoyance. One suggestion: the link would be half as annoying if it was easily cut-and-pasteable rather than a long email-open-tracking link spanning multiple lines. This is what it looks like when I copy it out of my email: https://email.mg.mercury.com/c/eJxMzs1u4jAUBeCncXZB9vVfvPACZshoWIwYoiasdgkra2KV_JCGqPTpK-imq7xxx40vlO9IKia6ggL6zUlQHObdF6\ JI0alRHBWQvWKRuD4loLZxsJSRXZAwfNBQeQWozasdgeWsMyFZozE4RKZ4d151NOFtuq9w6IqLb-d5fGdyzaBmUIdx_NkzqBeacrqXkZaMxGSNQyQmf7_9GW7\ Hf1cJ8zW9TshAwwba3ccLuN3u_r_PR9j_GkxxxmadDu32c59jMfkYFmKKP0baIT0vzP4ynHN_-yyhZOTy9jmPPQn6gL-VLMfvvIA_XxbywRYhUbZUp0RpVCUC\ qDsbasJHeObFMZ4YrFw1cAAAD__4XPZXw I have to manually remove the backslashes and re-combine the lines before pasting into my web browser. Edit to add: looks like email.mg.mercury.com is hosted by Mailgun. Are you intentionally sharing these authentication tokens with a third party by serving them through this redirect? Do your security auditors know about this?

jeremyjh 2y ago
You have to send emails through third parties or people won't get them, because you are also always sending them to third parties who host the recipients email and manage their spam. It might be a good reason not to send magic links but here we are talking about a tertiary confirmation, so its useless on its own right?
- dpifke 2y ago
  The link in the email could be a direct link to Mercury's website, rather than one that passes through a third-party HTTP redirect service. Authentication tokens (even tertiary ones) usually are supposed to have pretty strong secrecy guarantees. I've done multiple security audits for SOC, PCI, HIPAA, etc., and in every case the auditors would have balked if I told them signin tokens were being unnecessarily logged by a third-party service. (Also: I strongly disagree that the only way to get reliable delivery is via a third-party email service, especially at Mercury's scale, but that's a digression from the topic at hand.)
  - MaxGabriel 2y ago
    Oh good find, the link going through Mailgun as a redirect is a recent regression. We have a PR to fix that going live soon. That said, our security team and I agree there is no security issue here. Mailgun already can see the text of the emails we send.
    - dexterdog 2y ago
      How is there no security issue here? Email is not secure and it's even less so when you are sending it via a 3rd party. If this were a photo site or something that would not be a big deal but we're talking about a bank. SMS is not much better. Like somebody said elsewhere in the thread, you should allow people to opt out of insecure third-factor verifications since they are just an annoyance and are ultimately security theater.
      - adastra22 2y ago
        It's not security theater. He explained above how this is used to defeat a specific phishing attack that they've actually seen in the wild. There are other, different threat vectors (e.g. compromise of the mail server) that it doesn't prevent. But that doesn't make it theater. as it does provide other value.
        dexterdog 2y ago
        What does it stop? You already did a 2FA at this point. If an attacker has my 2FA he most likely already has my email so the 'value' being provided is at the cost of more complexity for the user. If this adds value then why not also do an SMS as well to be really, really sure that the user is legit? That would add even more value. And again, I wasn't saying that you can't do all of this nonsense, but users who see it as nonsense should be able to turn it off.
        edaemon 2y ago
        Why would the attacker having your Mercury TOTP mean they most likely have access to your email?
lyime 2y ago
What would be a more secure (yet reliable) method for email delivery for such emails?
- dpifke 2y ago
  Make the link in the email https://mercury.com/something https://mercury.com/something instead of https://mailgun.com/something https://mailgun.com/something (which then redirects to https://mercury.com/something https://mercury.com/something). Or (in addition to, or instead of, a hyperlink) provide a 6-10 digit numeric or alphanumeric code that could be copied out of the email message into a form field on the signin screen.
  - MaxGabriel 2y ago
    > 6-10 digit numeric or alphanumeric code that could be copied out of the email message into a form field on the signin screen. To be clear this is what we're trying to avoid. An easily typeable code like that can be typed into a phisher's website.
    - dpifke 2y ago
      How about giving me a setting to disable device verification: "I know how to type mercury.com into the URL bar and accept all risk of getting phished." I appreciate you guys are trying to protect people, but no other financial institution I deal with requires this level of annoyance, and at some point I'd rather switch to a less "secure," but more usable service. (I put secure in scare quotes, because some suggestions, like trading true 2FA, where I have two separate secrets on two separate devices, for a single WebAuthn factor, are actually accomplishing the opposite, at least for those of us who don't click links in emails and don't use ads on Google for navigation.) Edit to add: or maybe save the third factor for suspicious activity, such as "new device adding a new payee," rather than every signin. It's been months since I onboarded a new vendor, and I'd be OK with only having to do the cut-and-paste-the-link dance a couple of times a year, rather than every single time I want to check my balance.
  - sebastiennight 2y ago
mhitza 2y ago
At the very least, you can be creative with workarounds for such issues. A bookmarklet can be convenient. javascript:void(window.location.href = window.prompt().replace(/\\\n\s*/g, ''));
incompatible 2y ago
I set Firefox to delete cookies at shutdown, and also an add-on called Cookie AutoDelete, but they both have an option to whitelist a site.
packtreefly 2y ago
> I wasn't aware that WebAuthn didn't have this requirement. I prefer TOTP because I actually like having a second factor in addition to a credential stored on my computer's hard drive (whether a password or a private key in my password manager), but I might be willing to reduce my security posture to get rid of this annoyance. I've seen passkeys support something like what you're after. The browser will produce a QR code you scan with your phone, and then you authenticate with the passkey via the phone, which then authorizes the original browser. I'm not absolutely certain that this is part of the spec or how it actually works. I'd like to know. It solves a couple different usability issues. You could always use something like a Yubikey.
- dpifke 2y ago
  > You could always use something like a Yubikey. This is the option I prefer, but only on sites that allow me to enroll more than one device (primary, and backup for if the primary gets lost or damaged). AFAICT, Mercury only allows a single security key. I have an encrypted offline backup of my TOTP codes, so if I drop my phone on the ground, I don't get locked out of all my accounts. I keep this separate from the encrypted offline backup of the password manager on my computer, and as far as I know, neither has ever been uploaded to anyone else's "cloud." Malware would have to compromise two completely separate platforms to get into my accounts, rather than just iCloud or whatever credentials. I understand the desire for phish-proof credentials, but—given that I don't click links in emails—my personal threat model ranks a compromised device (via attack against a cloud service provider, or software supply chain attack against a vendor with permission to "auto-update," or whatever) much higher likelihood than me personally falling victim to phishing. I readily admit that's not true for everyone.
  - MaxGabriel 2y ago
    > AFAICT, Mercury only allows a single security key. We allow multiple security keys. You can add more here: https://app.mercury.com/settings/security https://app.mercury.com/settings/security
    - 2y ago
adastra22 2y ago
Pretty sure that is eMacs formatting, not the email itself? Can you kill-copy the URL?
deleted 2y ago
[deleted]
thefreeman 2y ago
So you are intentionally crippling your browser and ability to access email (you need to ssh to another computer and access via terminal). You also aren’t able to handle emacs wrapping of long lines. And you are complaining that the security in place to prevent stolen credentials is “inconveniencing you”.

by dpifke 2y ago

jeremyjh 2y ago

You have to send emails through third parties or people won't get them, because you are also always sending them to third parties who host the recipients email and manage their spam. It might be a good reason not to send magic links but here we are talking about a tertiary confirmation, so its useless on its own right?

dpifke 2y ago
The link in the email could be a direct link to Mercury's website, rather than one that passes through a third-party HTTP redirect service. Authentication tokens (even tertiary ones) usually are supposed to have pretty strong secrecy guarantees. I've done multiple security audits for SOC, PCI, HIPAA, etc., and in every case the auditors would have balked if I told them signin tokens were being unnecessarily logged by a third-party service. (Also: I strongly disagree that the only way to get reliable delivery is via a third-party email service, especially at Mercury's scale, but that's a digression from the topic at hand.)
- MaxGabriel 2y ago
  Oh good find, the link going through Mailgun as a redirect is a recent regression. We have a PR to fix that going live soon. That said, our security team and I agree there is no security issue here. Mailgun already can see the text of the emails we send.
  - dexterdog 2y ago
    How is there no security issue here? Email is not secure and it's even less so when you are sending it via a 3rd party. If this were a photo site or something that would not be a big deal but we're talking about a bank. SMS is not much better. Like somebody said elsewhere in the thread, you should allow people to opt out of insecure third-factor verifications since they are just an annoyance and are ultimately security theater.
    - adastra22 2y ago
      It's not security theater. He explained above how this is used to defeat a specific phishing attack that they've actually seen in the wild. There are other, different threat vectors (e.g. compromise of the mail server) that it doesn't prevent. But that doesn't make it theater. as it does provide other value.
      - dexterdog 2y ago
        What does it stop? You already did a 2FA at this point. If an attacker has my 2FA he most likely already has my email so the 'value' being provided is at the cost of more complexity for the user. If this adds value then why not also do an SMS as well to be really, really sure that the user is legit? That would add even more value. And again, I wasn't saying that you can't do all of this nonsense, but users who see it as nonsense should be able to turn it off.
        edaemon 2y ago
        Why would the attacker having your Mercury TOTP mean they most likely have access to your email?

lyime 2y ago

What would be a more secure (yet reliable) method for email delivery for such emails?

dpifke 2y ago
Make the link in the email https://mercury.com/something https://mercury.com/something instead of https://mailgun.com/something https://mailgun.com/something (which then redirects to https://mercury.com/something https://mercury.com/something). Or (in addition to, or instead of, a hyperlink) provide a 6-10 digit numeric or alphanumeric code that could be copied out of the email message into a form field on the signin screen.
- MaxGabriel 2y ago
  > 6-10 digit numeric or alphanumeric code that could be copied out of the email message into a form field on the signin screen. To be clear this is what we're trying to avoid. An easily typeable code like that can be typed into a phisher's website.
  - dpifke 2y ago
    How about giving me a setting to disable device verification: "I know how to type mercury.com into the URL bar and accept all risk of getting phished." I appreciate you guys are trying to protect people, but no other financial institution I deal with requires this level of annoyance, and at some point I'd rather switch to a less "secure," but more usable service. (I put secure in scare quotes, because some suggestions, like trading true 2FA, where I have two separate secrets on two separate devices, for a single WebAuthn factor, are actually accomplishing the opposite, at least for those of us who don't click links in emails and don't use ads on Google for navigation.) Edit to add: or maybe save the third factor for suspicious activity, such as "new device adding a new payee," rather than every signin. It's been months since I onboarded a new vendor, and I'd be OK with only having to do the cut-and-paste-the-link dance a couple of times a year, rather than every single time I want to check my balance.
- sebastiennight 2y ago

mhitza 2y ago

At the very least, you can be creative with workarounds for such issues. A bookmarklet can be convenient. javascript:void(window.location.href = window.prompt().replace(/\\\n\s*/g, ''));

incompatible 2y ago

I set Firefox to delete cookies at shutdown, and also an add-on called Cookie AutoDelete, but they both have an option to whitelist a site.

packtreefly 2y ago

> I wasn't aware that WebAuthn didn't have this requirement. I prefer TOTP because I actually like having a second factor in addition to a credential stored on my computer's hard drive (whether a password or a private key in my password manager), but I might be willing to reduce my security posture to get rid of this annoyance. I've seen passkeys support something like what you're after. The browser will produce a QR code you scan with your phone, and then you authenticate with the passkey via the phone, which then authorizes the original browser. I'm not absolutely certain that this is part of the spec or how it actually works. I'd like to know. It solves a couple different usability issues. You could always use something like a Yubikey.

dpifke 2y ago
> You could always use something like a Yubikey. This is the option I prefer, but only on sites that allow me to enroll more than one device (primary, and backup for if the primary gets lost or damaged). AFAICT, Mercury only allows a single security key. I have an encrypted offline backup of my TOTP codes, so if I drop my phone on the ground, I don't get locked out of all my accounts. I keep this separate from the encrypted offline backup of the password manager on my computer, and as far as I know, neither has ever been uploaded to anyone else's "cloud." Malware would have to compromise two completely separate platforms to get into my accounts, rather than just iCloud or whatever credentials. I understand the desire for phish-proof credentials, but—given that I don't click links in emails—my personal threat model ranks a compromised device (via attack against a cloud service provider, or software supply chain attack against a vendor with permission to "auto-update," or whatever) much higher likelihood than me personally falling victim to phishing. I readily admit that's not true for everyone.
- MaxGabriel 2y ago
  > AFAICT, Mercury only allows a single security key. We allow multiple security keys. You can add more here: https://app.mercury.com/settings/security https://app.mercury.com/settings/security
  - 2y ago

adastra22 2y ago

Pretty sure that is eMacs formatting, not the email itself? Can you kill-copy the URL?

deleted 2y ago

[deleted]

thefreeman 2y ago

So you are intentionally crippling your browser and ability to access email (you need to ssh to another computer and access via terminal). You also aren’t able to handle emacs wrapping of long lines. And you are complaining that the security in place to prevent stolen credentials is “inconveniencing you”.