Users of a service are waiting for something to happen - a money transfer for example.

An attacker might forge an email notification, that executes an XSRF attack.

Alternatively, I could leave it up to the user to check back as and when they want to, by visiting a web page. Over https, the notification they receive is encrypted and signed as being genuine.

My examples are biased against the flaws of email. There are lots of different types of push and pull messaging systems.

That said, I am curious to know if there is something inherently more secure in pull based designs?

  • 1
    Tricking the user happens outside of the messaging system. So I don't really see any inherent tradeoffs between which party initiates the communication. People are tricked all the time into visiting fraudulent websites, for instance. – Steve Sether Apr 15 '16 at 16:23
  • 2
    Also, I don't see that trust has much of any basis on push/pull. The trust model is based on some form of mutual authentication, not who started the communication. – Steve Sether Apr 15 '16 at 16:26
  • You can sign and encrypt emails too. Admittedly, most users and a significant proportion of MUAs don't know the difference compared to a plain text email. – symcbean Apr 15 '16 at 21:58

I don't think there is a big difference between the two models. If you implement the "push" model, which I'll call the "notification" model, the user can still log into the site before getting the notification. If you implement the "pull" model, which I think of as the "polling" model, an attacker can still email the user with a forged notification, effectively converting your no-notification polling model into a notification model (the attacker would need to know that a notification is expected to achieve this effectively). So, either way, you are basically supporting both models.

In the end, your user must be sufficiently sophisticated to avoid clicking on bad links in their email, and generally avoiding going to incorrect websites. If they aren't, then they are open to phishing and other attacks. Implement 2FA, consider something like U2F, train your users about phishing attacks, and make sure that you're support team knows how to respond to problems.

| improve this answer | |
  • I'm not sure why, but the wikileaks link to 2FA that you put up says, "2FA is ineffective against modern threats,[2] like ATM skimming, phishing, and malware etc."...? – user2800708 Apr 15 '16 at 21:37
  • @user2800708 a phisher can ask for your 2fa information and then immediately pass it to the real site for a login. U2f prevents this. – Neil Smithline Apr 15 '16 at 22:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.