0

I use a service for improving my English which includes authentication for users, it has a feature for sending emails for some types of new exercises. I was surprised when I saw the URL for emails:

https://puzzle-english.com/video/arnold_openspace?autologin_key=*long_hash*&user_email=*my_email*&expire=1533573237&pes=email_letter_every_day

autologin_key is different for all emails. If I get it the right way, this URL allows anyone to login to my account without even knowing the password.

Is this a potential vulnerability?

UPD: this key allow full access to my account, including changing personal information, like email and password (it will make impossible to recover access for me).

  • Any change password or email settings should request authentication is you were allowed to autologin – bradbury9 Jul 31 '18 at 11:20
2

Obviously the service providers assumes that only you can access your mail account. The service provider decided that a temporary value of autologin_key with probably limited validity period is secure enough to authenticate you.

Whether the (rather bad) e-mail confidentiality is really secure enough depends on what harm an attacker can do to you or the service provider.

E.g. does this credential authorize you to...

  • just access read-only content of training courses or
  • does it allow see personal data
  • does it even allow modifying your personal data, e.g. consuming training stuff making it unusable/unreachable for you
  • or even worse to order more services you will be charged for

After all it's always a choice of convenience vs. security. Sometimes the trade-off can be hard to find.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.