3 ms·
Authentication tokens should expire after first use; other sanity checks: 1. Tokens should expire after no more than five minutes. 2. Embed a 1-pixel image in
by thangalin 13y ago
Authentication tokens should expire after first use; other sanity checks:
1. Tokens should expire after no more than five minutes.
2. Embed a 1-pixel image in an HTML-based e-mail also contains the token. When the e-mail is first opened, the server associates the IP address from the e-mail with the token. Only subsequent authentication requests for that token/IP address pair pass validation.
3. Log IP addresses used by an account. Additional new IP addresses outside the usual geographical area (GeoIP) should fail validation. This assumes that the first person to click the link is the intended recipient.
Any other ideas?
- pferde 13y agoThese are all ideas which would cover maybe 80% of use cases, but severely annoy the remaining 20%. Is that a good idea?
- jessaustin 13y agoThe fallback can be that you have to log in with a password. Which is bad, but apparently tolerable.
- mattmanser 13y ago2 Won't work any more now that Google have led the charge with downloading images in email messages to their own servers and serving them to users themselves. I expect all email providers to follow Google's lead on that tbh because it's really quite good. 3 is a bit of a problem with residential broadband as IP address get re-assigned a fair bit.
- JimDabell 13y agoUse a persistent identification cookie even when the "remember me" checkbox isn't used. By themselves, neither the cookie nor the email nonce are enough to authenticate. But if you have both at once, you are authenticated. This will cover almost everybody, it will have almost no false positives (forwarding an email to somebody who uses the same browser on the same computer is the only one I can think of off the top of my head), and the fallback of requiring explicit authentication in other cases seems acceptable.