0

Most sites that take security seriously, try to identify the moment when you use a new (or "unfamiliar") device to sign in to your online account. Example, when you sign in from a different computer to mail.google.com they'll ask you for 2FA or at the very least send you a mail stating that they detected you signed in from a new location (with a method to block access).

My thoughts are to either store a random hash (or heck even a JWT token) in a cookie. Though, this poses the problem that if the user clears their cookies they'll get asked for 2FA. This in itself isn't an issue, but I'd like to avoid that if I can.

That brings me to perhaps using an ever-cookie (something like https://github.com/samyk/evercookie). However, that might be frowned upon as me trying to track them for dark purposes).

I can't ascertain what the acceptable behavior here should be.

Opinion?

2
  • Asking for an opinion is considered out of scope for the site, as it is primarily focused on the Q&A format with real answers. You may want to edit the question. For example, you could ask about pros and cons of using an evercookie-like approach, or ask if there are other methods or techniques to identify devices for the purposes of forcing 2FA from "unfamiliar" devices.
    – Jesse K
    Commented Aug 14, 2017 at 18:09
  • @JesseKeilson ah sorry mate, my bad.
    – Sarel
    Commented Aug 14, 2017 at 19:56

1 Answer 1

1

The acceptable behaviour in my opinion is simply to inform the end user of why? & what? is being done by your system, so atleast they can evaluate if they would like to use it, and maybe give them the chance to disable it.

All this can also be done without cookies, you could catch the devices "fingerprint" when login is performed and check if that "fingerprint" is allowed or not : new device fingerprint (notify owner)

Since you mention JS here is a Device Fingerprinting Lib : ClientJS

1
  • Thank you EMX - due to the fact I phrased the question wrong, and you the only person who answered it's only fair I mark this as accepted.
    – Sarel
    Commented Aug 15, 2017 at 5:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .