Timeline for Security requirements for one time access code/token in the url
Current License: CC BY-SA 3.0
8 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Apr 16, 2016 at 14:28 | history | tweeted | twitter.com/StackSecurity/status/721344479236648962 | ||
| Apr 15, 2016 at 14:59 | history | edited | Ilya Chernomordik | CC BY-SA 3.0 |
added 1 character in body
|
| Apr 15, 2016 at 14:49 | vote | accept | Ilya Chernomordik | ||
| Apr 15, 2016 at 14:46 | answer | added | Xander | timeline score: 6 | |
| Apr 15, 2016 at 14:00 | history | edited | Ilya Chernomordik | CC BY-SA 3.0 |
added 74 characters in body
|
| Apr 15, 2016 at 13:59 | comment | added | Ilya Chernomordik | Yes, thank you. We plan to make it limited to either on time or one day, I'll add it to the question. | |
| Apr 15, 2016 at 13:46 | comment | added | John Deters | Since you're sending it via SMS, you'd strengthen this quite a bit if the token were valid for only one login. Allowing the token to be used for a limited time period, say 24 hours, might also help. If you allow reuse of the URL, consider limiting the subsequent logins to the same browser that made the original request, validated with cookies distributed during the first login. | |
| Apr 15, 2016 at 13:35 | history | asked | Ilya Chernomordik | CC BY-SA 3.0 |