Timeline for Is this password-less auth flow secure?
Current License: CC BY-SA 4.0
22 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Feb 15, 2020 at 8:35 | review | Close votes | |||
| Feb 20, 2020 at 3:05 | |||||
| Feb 15, 2020 at 8:16 | comment | added | Basj | Does this answer your question? Password-less authentication in web apps - How safe it is? | |
| S Nov 28, 2018 at 5:03 | history | bounty ended | CommunityBot | ||
| S Nov 28, 2018 at 5:03 | history | notice removed | CommunityBot | ||
| Nov 26, 2018 at 5:57 | comment | added | MPS | What happens if i can/"want to" only access my email on a different device? | |
| Nov 25, 2018 at 17:41 | answer | added | Tobias Bergkvist | timeline score: 2 | |
| Nov 21, 2018 at 12:38 | comment | added | Peter Scott | Although the answers provided all make solid cases and I'd take the advice seriously - you may also wish to include combining the link emailed to the user with a password sent by SMS to require both parts to validate. Of course there remains an issue with SPAM though you may be able to restrict to expected geo users by filtering the mobile number etc. | |
| Nov 21, 2018 at 5:20 | answer | added | AlphaD | timeline score: 5 | |
| Nov 20, 2018 at 21:12 | comment | added | klinore | @Adonalsium, that was my thought. I actually initially required a password, but took it out after I thought about it a little more. These users won't need to sign in and out often, so it didn't make sense to me to make them remember a password. And if I DID implement a password, I'd have to allow them to reset with email which is a nearly identical flow. I couldn't figure out how is resetting a password via email any more secure than this 🤔. If anything, this has less vulnerabilities. | |
| Nov 20, 2018 at 14:03 | comment | added | Monica Apologists Get Out | Worth mentioning that the central concept is no less secure than any website that allows you to reset your password via an 'forgotten password' process that sends an email to you - this just has less steps and is used every time. | |
| Nov 20, 2018 at 13:51 | answer | added | Alex | timeline score: 2 | |
| Nov 20, 2018 at 9:33 | comment | added | GxTruth |
[Changed my answer to a comment, as I read over your request for offical sources; my bad] Make sure the secret is securely and randomly generated. Also you should prevent one token being used twice to receive a permanent session. In addition, when sending the permanent token to the used, avoid putting it in the GET parameters. Lastly, make sure to invalidate sessions server-side if users log out or change their password (in the latter case, invalidate *all sessions associated with that user).
|
|
| Nov 20, 2018 at 6:00 | history | tweeted | twitter.com/StackSecurity/status/1064760344885772288 | ||
| S Nov 20, 2018 at 3:44 | history | bounty started | klinore | ||
| S Nov 20, 2018 at 3:44 | history | notice added | klinore | Authoritative reference needed | |
| Nov 18, 2018 at 16:05 | history | edited | klinore | CC BY-SA 4.0 |
added 313 characters in body
|
| Nov 17, 2018 at 19:03 | history | edited | schroeder♦ | CC BY-SA 4.0 |
deleted 3 characters in body
|
| Nov 17, 2018 at 18:33 | comment | added | Daisetsu | This question may be a good read too security.stackexchange.com/q/197004/39616 | |
| Nov 17, 2018 at 18:32 | comment | added | Daisetsu | You will want to make sure your email server uses TLS or all your emails will be bounced around mail servers in the clear. Even with TLS on your email server the recipient needs it too or email is sent clear-text. I'm guessing this is a very low security (requirement) application. Have you considered using OAuth2? It allows people to sign up using credentials like Google, Facebook, etc. | |
| Nov 17, 2018 at 18:29 | comment | added | Daisetsu | You should avoid using the word "auth" as it can be ambiguous whether you mean authentication or authorization. Of course it becomes clear you meant authentication by reading your context, but it takes more time for the reader to understand your question. | |
| Nov 17, 2018 at 18:05 | review | First posts | |||
| Nov 18, 2018 at 1:33 | |||||
| Nov 17, 2018 at 18:03 | history | asked | klinore | CC BY-SA 4.0 |