Tag Info

New answers tagged

1

The problem you are trying to solve is that the client needs to be identified by the server (to know which user this is) but the server needs also be reliably identified by the client to detect phishing. I agree that simply using HTTPS for identification of the server is not enough, since an attacker might simply own a similar looking domain (e.g. paipal.com ...


1

Security measures strengthen in inverse proportion to convenience... so I probably wouldn't do this... and I don't know a single site that does this... but... you did ask. How about a workflow like this: User accesses web site and enters user name Site looks up user's phone number and sends one time code or a random word as SMS. Site displays one time ...


1

I know of one that let's users upload a picture of their own choosing when the account is set up. (They can change it later.) The picture is shown on the password screen, after the user ID is entered. Wrong or no picture == fake web site. You would want to use a back-end program to make the pics a standard size and to strip out meta data before storing ...


1

Bear in mind that when you enable third-party account authentication in your application it is because you're delegating Identification AND Authentication to that third-party, that you choose to trust. For instance, if the user chooses to login to your application using a third party account, your application doesn't have to be aware when the user changes ...


3

Why are you assuming it is a "person" who called you? Most people will just Google the number - typically if this is one of those spam callers you will find out some information about them on discussion groups. I am not sure why it would be illegal to search publicly available information about a phone number that called you.



Top 50 recent answers are included