Timeline for How long should a email confirmation code be to avoid brute forcing
Current License: CC BY-SA 3.0
12 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Sep 21, 2017 at 18:17 | answer | added | Exhibitioner | timeline score: 0 | |
| Sep 17, 2017 at 17:23 | vote | accept | Bufke | ||
| Sep 17, 2017 at 17:21 | comment | added | vidarlo | @Bufke Thanks :) Too short for an answer in my opinion, but... | |
| Sep 17, 2017 at 17:21 | answer | added | vidarlo | timeline score: 1 | |
| Sep 16, 2017 at 18:47 | answer | added | ShayanKM | timeline score: 0 | |
| Sep 16, 2017 at 18:33 | comment | added | vidarlo | It's slightly more work - but it's significantly easier for the user if they read their e-mail on a separate device, and also provides whatever security level you require without a long string. | |
| Sep 16, 2017 at 15:20 | comment | added | Bufke | @vidarlo I like your answer a lot. It's slightly more development intensive having basically two systems to confirmation but really checks all the UX boxes. | |
| Sep 16, 2017 at 15:13 | comment | added | vidarlo | Provide a URL with a long identifier, user not having to login, and a short 4-digit code, where the user has to log in, and limit to for instance 5 attempts per 24hr. And it's not like it's hard to get an e-mail account today, so it's of limited overall value. | |
| Sep 16, 2017 at 14:47 | comment | added | Steffen Ullrich | @Bufke: if the user is entering the code within the same session as he created the user then you already have the identity belonging to the token and there is no need to ask for it again. An attacker would not only need to guess the token but also the session cookie. If the user is outside the session (maybe different browser) you can still ask for the claimed identity. | |
| Sep 16, 2017 at 14:42 | comment | added | Bufke | I think the token with email link is a pretty good solution. But it removes the ability to just view the confirmation code in email and type it in. I imagine some situation where a user see the code fly up in a notification on their phone and just types it in on their desktop. That said this may still be the best UX possible. I might be over thinking possible papercuts when signing up. That said I see a lot of short codes out in the wild. | |
| Sep 16, 2017 at 14:32 | comment | added | TrickyDupes | Why not just use a token in the url link the email contains? One that ids the user and authenticates the request, that way it is all automatic? No need for codes etc. | |
| Sep 16, 2017 at 14:23 | history | asked | Bufke | CC BY-SA 3.0 |