3 ms·
We really need to systematically implement in our login systems what many ssh access does when you login : "Hello <username>. Your last login was at <time> from
by oelmekki 13y ago
We really need to systematically implement in our login systems what many ssh access does when you login : "Hello <username>. Your last login was at <time> from <ip>".
It won't solve the problem, but it'll certainly help a bit.
EDIT after a few comments :
This will not make it impossible to steal identity. But this will cost us almost nothing and imply high cost for spooks : if you have a user password, you can use it on many website, for common users, without the related company even knowing it. If you implement last login timestamp, it's something you can do within hours, without any need for heavy architectural changes, and it will cost a lot to spooks to try to fake it on every websites, for a large amount of users.
Cheap to us, costly to them. That's the way to go for me.
- chrischen 13y agoThey could always modify that as well.
- oelmekki 13y agoWell, in the context of a specific targeting, certainly. I have no problem with that. What is a problem is mass surveillance. A simple measure like that could make it very costly to achieve mass operations. EDIT : also, please note that the problem with password is that once you get one, for common people, you can hope they used it on many other sites. This allow feds to access website without the company even knowing it. If you have to fake login timestamp, all related companies must be aware of your action.
- sgk284 13y agoGoogle already does this with GMail. Scroll down to the bottom and it's in the lower right corner. Facebook also provides access to all recent/active sessions and their last accessed time under Settings -> Security. They've got all kinds of other good security features that are worth enabling too. I suspect a better long-term approach here is going to be something like Mozilla Persona (with the option of easily using your own domain for auth & auth if you like). Then the service doesn't have your password. They could still give the Feds access to your data, but at least the Feds won't be able to leverage your password against other services (greater adoption of password managers would also help this scenario). And of course, enable two-factor auth on any site that supports it.
- oelmekki 13y agoYes, a friend of mine mentionned the google feature. I never noticed it. But as I say, we need something that everyone can implement right now and that makes mass surveillance cost too expensive to be realistic. Log history and 2 steps login (for example) are something that need heavy architectural changes, while showing the last log can be done at no cost.
- BadassFractal 13y agoIs there anything to prevent them from creating a separate unlogged login system specifically for this kind of use?
- oelmekki 13y agoNope. We can't achieve total security. One may argue it's a good thing : there actually are a few bad guys, out there. But the cost to apply this to every single website they want to spook on will be prohibitively high to implement massive use.
- jlgreco 13y agoThere isn't, but if they are going that route then why do they want the passwords?