4 ms·
That’s why you combine it with a check for source IP and tell your user that they need to approve from a device that has same IP as the one they are logging in
by codetrotter 2y ago
That’s why you combine it with a check for source IP and tell your user that they need to approve from a device that has same IP as the one they are logging in on. So if I’m logging in on my laptop, and approving with my phone, it will be rejected if my phone is using mobile data while my laptop is using landline, but will approve if my phone is connected to WiFi of the same network my laptop is connected to, or if my laptop is tethered via my phone, because then I have same external source IP on both devices.
- witrak 2y agoThis scenario is a solution only in simplest cases. It doesn't work when someone routinely uses a VPN on the phone (when often uses free public wi-fi in airports, railway stations, markets etc) because of possible MITM attacks.
- asddubs 2y agoalso some ISPs will give you a different IP every request
- apitman 2y agoThis has security and usability issues. NAT/CGNAT means a potentially large number of people can hijack your login.