3

I have built a web-facing tool which is mostly for internal use, but some of our clients will also make use of it. When building the registration/login parts I had a thought about who would be using it and how they would use it.

Often, there will be an account that is owned by a client, and the account will have many users, who will have varying levels of access to do things.

When a new user needs to be added to an existing account, there is a problem. I see a common situation in many other tools where an admin who is already authenticated (logged in) will have access to a "create new user" section where they can set up a new user, choose a password etc. and pass the new credentials onto the new user. This opens up more issues than I care to mention, but I'm sure anyone reading this can think of many.

I thought of the following alternatives

  • Admin creates the new user account and an email is sent to the new user who must then use a link in the email to set a password before the account can be used. I like this idea but a typo in the email address could give someone else access which is undesirable.

  • Admin creates a time-limited one-time-key which they can give to a new user. New user then enters their details on a registration form along with the OTK, which authenticates that user as being a member of the desired client/account.

The second option seems far better, the only thing being transmitted insecurely is the key which is single use and time limited, and can be redacted by the admin if necessary, but I haven't seen this method in use anywhere and wonder why.

Are there any flaws with this method that I have overlooked?

What other options have I not thought of?

  • In #2, how does the admin give the user the OTK? – multithr3at3d Mar 5 '18 at 17:33
  • @multithr3at3d any secure or insecure method they like.shout it from a rooftop perhaps "Dave, your key for that tool we spoke about is XYZ123" – Darren H Mar 5 '18 at 17:41
  • Is that really any better than email? – multithr3at3d Mar 5 '18 at 17:42
  • 1
    No, it's insecure. As is email. And whatever other way an admin chooses to pass the information. It's out of our control, that's the point. It's why I'm focusing on WHAT needs to be transmitted rather than HOW. – Darren H Mar 5 '18 at 17:44
  • For option 2, if the user and admin are meeting in the first place, why not just have an admin-only signup system where they take the email address and sign them up? This is actually how many businesses create and manage trade accounts. – Polynomial Mar 5 '18 at 17:47
2

You could this the following way:

Instead of having the admin create the account and contact the user, have the user request access through a web form. The user can set an initial password right there, and also gives his e-mail address.

Then, the admin gets notified that there is a new user registration request which he has to approve.

The admin then needs to authenticate the user before approving him; this could be done by the system automatically verifying his e-mail address (depending on whether you automatically trust everyone at a given mail domain - I'd counsel against it), or by handing out one-time access tokens to specific people beforehand, to be entered as part of the registration form (much more secure).

So basically this is your solution, just with the initial contact reversed.

This reversal has one (slight) advantage: If you do verification automatically by e-mail, you've now solved the misspelled e-mail problem. Consider Alan Turing requesting access and misspelling his e-mail address so that the authentication request goes to Alai Turing instead. Alai might pretend to be Alan, but he won't be able to sign in, since he doesn't know Alan's password. You'll just have to make sure that passwords can't be reset until after the first successful sign-in (basically an account is only considered authenticated and active when both a sign-in and e-mail verification have occured)

Note that the automatic e-mail verification I described only protects against accidental misspellings of the e-mail address. If Alai signs up with the full intent of posing as Alan, this won't protect you.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.