11–20 of 40 posts
To log in, you type in the e-mail. The server sends an email with a link (with secret code), which in turn sets a cookie when visited. The cookie expires in a month or so, and gets refreshed with every visit to the site. So the user only goes through the login process on a new computer.
One problem with this: it's too different from what's in place now. So users will be confused, at least initially. But this is actually an interesting idea.
Because you don't want your sysadmin logging into your favorite dating site as you? If you are going to do this right, you need email encryption. In which case, you have a client-side certificate. In which case, you might as well just authenticate over SSL with that certificate. But hey, why do something secure and built-in to every browser (even IE) when you can invent your own protocol instead? It's the Internet! A…
Because you don't want your sysadmin logging into your favorite dating site as you? If you are going to do this right, you need email encryption. In which case, you have a client-side certificate. In which case, you might as well just authenticate over SSL with that certificate. But hey, why do something secure and built-in to every browser (even IE) when you can invent your own protocol instead? It's the Internet! A…
Also, I'm sure I have a dozen restore password emails in GMail somewhere. And I'm sure I'm not alone.
It works for password reset because the window of opportunity is small (just a few minutes) and it is a once-only operation (visiting the URL again should not reset your password again).
If you mean logging in via clicking a link in an email then it is too much of a security risk. Think of all the places that URL can end up in: browser history, bookmarks, etc. It works for password reset because the window of opportunity is small (just a few minutes) and it is a once-only operation (visiting the URL again should not reset your password again).
What about the browser automating the procedure to openid?
Because you don't want your sysadmin logging into your favorite dating site as you? If you are going to do this right, you need email encryption. In which case, you have a client-side certificate. In which case, you might as well just authenticate over SSL with that certificate. But hey, why do something secure and built-in to every browser (even IE) when you can invent your own protocol instead? It's the Internet! A…
In general, if someone can read your email, they can steal almost any of your accounts. Are email accounts generally that insecure? I trust any major Webmail provider to not steal my bank account, but is trust the only thing really keeping our bank accounts secure?
If we really are that insecure, then people are probably going to attack your bank account long before they attack your random web-app account. If your site isn't guarding valuables, it's probably perfectly "safe" to send authentication tokens in mail messages. No?
It could be done, and pretty easily too. To log in, you type in the e-mail. The server sends an email with a link (with secret code), which in turn sets a cookie when visited. The cookie expires in a month or so, and gets refreshed with every visit to the site. So the user only goes through the login process on a new computer. One problem with this: it's too different from what's in place now. So users will be confus…
This topic has been up for a whole hour and no comment from tptacek? What's going on??
Because you don't want your sysadmin logging into your favorite dating site as you? If you are going to do this right, you need email encryption. In which case, you have a client-side certificate. In which case, you might as well just authenticate over SSL with that certificate. But hey, why do something secure and built-in to every browser (even IE) when you can invent your own protocol instead? It's the Internet! A…
How come people are not upset that the "forgot password" protocol is not secure?