3

I'm trying to make a system where the sign up would be allowed or denied based on the domain of the mail.

So let's suppose that only people from company.com are allowed to sign up on that system.

Let's pretend that the system admin from company.com has total control of all mail addresses that are created.

My question is, is there any security issue that would allow someone that does not belong to that company to get sign up on the system?

Would an attack as DNS poisoning affect this system making mails to be redirected to another domains?

Improve this question
1
  • 1
    I think one issue could be email spoofing, but you could use something like DMARC to prevent it.
    – A. Darwin
    Jun 15, 2016 at 9:46

1 Answer 1

Reset to default
2

I think it would be enough if you can actually restrict the Sign up process to specific domain(s) in the Application itself.

Three very important security points I can think of are below

  1. You can actually have a list of allowed domains for signup and thoroughly check every signup email against this list.
  2. Also should verify the signed up email by sending a activation link with unique and long(>32 charterers) random token. This verification should be mandatory before granting access to prevent abuse by others.
  3. You are right about DNS. The activation mail you send will be delivered after doing a DNS lookup for the MX record of domain. So,you have to be sure that you use very secure DNS servers like Google public DNS . A wrong DNS look up can make the email delivered to wrong inbox.

In the answer i mentioned the mandatory checks which have to be done as per your question.

You can have additional security measures in place like encryption(HTTPS) and Two Factor Authentication etc depending on your business needs.

Improve this answer
3
  • 1
    In addition: If you know the domain names, which are allowed to signup and you know the mailserver of these domains, you could only deliver the activation link if the receiving mail server offers starttls with a valid, signed and trusted certificate. At least this raises the fence a bit.
    – cornelinux
    Jun 16, 2016 at 4:55
  • @Sravan, I guess that my question was not clear. What I want to know if in your step two, mail verification, an attacker can pretend in anyway that he has the mail of the company.com and actually get access granted to the system.
    – Rubico
    Jun 20, 2016 at 9:21
  • @Rubico If you have proper defenses like long unique validation key(step 2), secured DNS lookup(step 3), HTTPS(signed and trusted), also using starttls (signed and trusted) as @cornelinux suggested. I think the attacker has no chance of pretending that he has company.com email id. Only exceptions i can think of are he already infiltrated the mail servers/network/end points of company.com. You can use 2FA to mitigate this risk of attacker infiltration to some extent.
    – Sravan
    Jun 21, 2016 at 8:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .