3 ms·

Passwords are weird. You give a site your user name and password via a form. Your browser converts these into a http request to a link via parameters. The site

by OliverM 12y ago

Passwords are weird. You give a site your user name and password via a form. Your browser converts these into a http request to a link via parameters. The site sends you your account page, or makes you try again if you fluffed it. Isn't this the equivalent of giving somebody private URL, like in the article? It's essentially the same, functionally, as a password you remember. Except passwords are less secure, as people use the same ones repeatedly, or generate them from a simple system repeatedly (less vulnerable to automated password guessing attempts, but as vulnerable to a dedicated human attacker). Are their web frameworks that let you determine if a user is genuine by their behaviour as much as their passwords? E.g. if I usually log in from the US, why am I suddenly logging in from Russia, less than a half-hour since I logged in via the US?

boobsbr 12y ago
That's an interesting idea. But when you submit your user/pass and are logged in, a cookie is set on your browser, and then a private link with your page is sent back to you. To access the private link, you'd need to be authenticated by that cookie. And the only way to obtain the cookie is through a user/pass form.
- lazyjones 12y ago
  > But when you submit your user/pass and are logged in, a cookie is set on your browser, and then a private link with your page is sent back to you. Not necessarily. Usually either the link is public (i.e. the same for everyone) and the session ID is in the cookie, or the session ID is in the URL (considered unsafe). This is the default behaviour of various Java application servers when cookies are disabled, for example (a jsessionid=... paramter is added to the URL). The "unique private URL" concept is then functionally equivalent to session IDs in the URL with sessions that never expire.
thret 12y ago
I was burned by something like that just yesterday. I've never used my mobile to log onto my email before, but after taking a 4hr trip and expecting an email, I tried and found myself locked out. This despite having the correct password, but it ran me through 'secret questions' which I filled out with gibberish about 20 years ago because I correctly believed they were a security risk. Thanks for that hotmail, very helpful.
- deleted 12y ago
  [deleted]
aestra 12y ago
>if I usually log in from the US, why am I suddenly logging in from Russia, less than a half-hour since I logged in via the US? This can happen if you use Tor, a proxy, etc.
mtdewcmu 12y ago
Some good questions. >>Isn't this the equivalent of giving somebody private URL, like in the article? It's essentially the same, functionally, as a password you remember. Except passwords are less secure, as people use the same ones repeatedly, or generate them from a simple system repeatedly (less vulnerable to automated password guessing attempts, but as vulnerable to a dedicated human attacker). Sort of, but not exactly. Login forms, when correctly submitted, usually set a session cookie in the browser. Cookies are sent back to the server with later requests, so you could think of the cookie as if it was part of the URL. Every time you log in, though, you get a cookie with different data inside. That's different from a private URL, because the private URL would always remain the same once it has been assigned. If the private URLs are generated by a secure random number generator, then they could potentially be more secure than passwords are. Being secure and hard to guess also makes them long and difficult to remember; and that's why passwords are used far more often than random private links. Passwords are meant to be possible for a person to remember and type. Also, passwords are possible to change, so if your password is compromised, you can keep your account and just change the password. >>Are their web frameworks that let you determine if a user is genuine by their behaviour as much as their passwords? E.g. if I usually log in from the US, why am I suddenly logging in from Russia, less than a half-hour since I logged in via the US? I'm not sure if there are frameworks for that, but I know that some companies have implemented similar kinds of things. Bank of America's website that allows you to access your account data adds a few extra features that add security to the standard username/password combo.

by OliverM 12y ago

boobsbr 12y ago

That's an interesting idea. But when you submit your user/pass and are logged in, a cookie is set on your browser, and then a private link with your page is sent back to you. To access the private link, you'd need to be authenticated by that cookie. And the only way to obtain the cookie is through a user/pass form.

lazyjones 12y ago
> But when you submit your user/pass and are logged in, a cookie is set on your browser, and then a private link with your page is sent back to you. Not necessarily. Usually either the link is public (i.e. the same for everyone) and the session ID is in the cookie, or the session ID is in the URL (considered unsafe). This is the default behaviour of various Java application servers when cookies are disabled, for example (a jsessionid=... paramter is added to the URL). The "unique private URL" concept is then functionally equivalent to session IDs in the URL with sessions that never expire.

thret 12y ago

I was burned by something like that just yesterday. I've never used my mobile to log onto my email before, but after taking a 4hr trip and expecting an email, I tried and found myself locked out. This despite having the correct password, but it ran me through 'secret questions' which I filled out with gibberish about 20 years ago because I correctly believed they were a security risk. Thanks for that hotmail, very helpful.

deleted 12y ago
[deleted]

aestra 12y ago

>if I usually log in from the US, why am I suddenly logging in from Russia, less than a half-hour since I logged in via the US? This can happen if you use Tor, a proxy, etc.

mtdewcmu 12y ago

Some good questions. >>Isn't this the equivalent of giving somebody private URL, like in the article? It's essentially the same, functionally, as a password you remember. Except passwords are less secure, as people use the same ones repeatedly, or generate them from a simple system repeatedly (less vulnerable to automated password guessing attempts, but as vulnerable to a dedicated human attacker). Sort of, but not exactly. Login forms, when correctly submitted, usually set a session cookie in the browser. Cookies are sent back to the server with later requests, so you could think of the cookie as if it was part of the URL. Every time you log in, though, you get a cookie with different data inside. That's different from a private URL, because the private URL would always remain the same once it has been assigned. If the private URLs are generated by a secure random number generator, then they could potentially be more secure than passwords are. Being secure and hard to guess also makes them long and difficult to remember; and that's why passwords are used far more often than random private links. Passwords are meant to be possible for a person to remember and type. Also, passwords are possible to change, so if your password is compromised, you can keep your account and just change the password. >>Are their web frameworks that let you determine if a user is genuine by their behaviour as much as their passwords? E.g. if I usually log in from the US, why am I suddenly logging in from Russia, less than a half-hour since I logged in via the US? I'm not sure if there are frameworks for that, but I know that some companies have implemented similar kinds of things. Bank of America's website that allows you to access your account data adds a few extra features that add security to the standard username/password combo.