4 ms·
My assumption is that a "login key" is essentially a large piece of data that would be prohibitively inconvenient to use outside of an email account, text, etc.
by jordanpg 12y ago
My assumption is that a "login key" is essentially a large piece of data that would be prohibitively inconvenient to use outside of an email account, text, etc. Analogous to a large session cookie without an expiration date.
In contrast, a password is designed to be used from any login point.
In this regime, unless the optional password is used, there is no hashed password stored on Mozilla's servers. Only a copy of the hash of the "login key" is stored, so the attack surface is considerably shrunk if you are attacking Webmaker users.
- dekz 12y agoThe login key is in the article in the example screenshot[1]: 'hopping-smiles'. [1]: http://notebook.ideapublic.org/wp-content/uploads/sites/5/2014/09/login-email-2.png http://notebook.ideapublic.org/wp-content/uploads/sites/5/20...
- jordanpg 12y agoMore technical details here from the post: https://chrisdecairos.ca/one-time-passwords-pt-2/ https://chrisdecairos.ca/one-time-passwords-pt-2/ I'm not totally clear about what the different between a "login key" (short-lived, pronounceable) and whatever is contained in these semi-permanent login email links (~1 year, presumably non-pronounceable).