Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

What would be a security risk for a website feature that allows you to connect to your account without typing your password, given that you allowed such a login for the next say 10 seconds from a second secured device of yours.

A simple use case is that your are trying to log in from an unsecured pc. You do not want keyloggers accessing your keystrokes, but you still need to gain access to your account on that insecure location.

share|improve this question
add comment

2 Answers

up vote 6 down vote accepted

Attackers knows all about automation. Ten seconds are a lot of time for an attacker who knows how to write scripts. In your scenario, if the insecure PC is malicious, it can use this very small window to enact a lot of harm: contrary to a human user, the attacker is not limited to how fast he can move a mouse.

I suppose that you want to login with your smartphone, and, from that smartphone, allow access to your account for "ten seconds" from the possibly malicious PC; the idea being that you do not want to type your precious password on that PC. This will indeed be beneficial to you if you assume that the PC just passively grabs passwords, but will not actively connect to whatever Web site you wish to use. Not all attackers can be trusted for being so polite, though.

Another similar but much more common and robust solution is to use one-time passwords. Instead of opening your accounts to everybody, even for a short time, use a password which works only once. Key loggers can log it, it won't matter, since the server will not accept each password more than once. You still have all the issues with maliciously active insecure PC: once you accept to use the bad guy's machine, you are giving him, virtually, access to your account for at least the few seconds you are using it, and that's enough to forfeit your security.

share|improve this answer
    
the thing about one time passwords is that they are more complicated for the user to type it in. I am looking for an easy solution to encourage the user to never type in their passwords except on their secured devices. –  M.C. Aug 26 '13 at 15:18
    
But how can an attacker know when the user activated this feature? An Attacker would have to try to connect to all accounts all the time –  M.C. Aug 26 '13 at 15:20
    
The connection to the server comes from the machine that the attacker controls. He can simply keep track of every connection to a given server; if he sees one, boom, there he goes. –  Tom Leek Aug 26 '13 at 15:27
    
Also, on my own server I receive hundreds of connection attempts per day, from attackers who just try their luck. This is also easy for attackers. –  Tom Leek Aug 26 '13 at 15:28
add comment

The better option is to produce a temporary password that can be used on the secondary device. Make a one time use password that is valid for 5 to 30 minutes. Any time left unsecured could be exploited, particularly if they are able to monitor the IP of a connection and thus make a guess about the user.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.