3

Consider the following strawman application, which remembers your TODOs.

  1. Application has a destination email "todos@todosaver.com"
  2. Users (already registered through normal means) send emails to the above domain, expecting their TODOs to be saved
  3. The application, upon receiving the message, stores its content.

Later, auser visits todosaver.com, logs in, and retrieves this content.

This worries me because you can spoof the email source address (e.g., Alice sends todos@todosaver.com and email faked as from bob@gmail.com containing malicious content).

In this case, I would imagine that an approach that both:

  1. sanitizes the email content
  2. displays the escaped text only

is probably sufficient, but am worried about this general approach now where (1) an email is verified by sending the user and email and (2) from then on, emails from that user are used for identity in this way. It feels like there should be a better way to do this (for instance, the above approach still lets malicious actors post spam to user's webpages).

What are established approaches to establishing identity through email, and what are their security/usability tradeoffs?

  • First you should ensure SPF, DKIM and DMARC are validated before accepting the email. – Esa Jokinen Jun 2 at 18:08
  • @EsaJokinen: None of this validates the sender. It only validates the senders domain which is not sufficient for typical public mail services (i.e. gmail, yahoo...). – Steffen Ullrich Jun 2 at 18:17
  • Gmail allows spoofing sender addresses of other Gmail users? – Esa Jokinen Jun 2 at 18:34
  • @EsaJokinen: I don't know about gmail specifically and I don't know about all the other public mail providers. But I'm pretty sure that some will do. But even then, usage of DMARC is still not sufficient to make this an actual requirement (GMail, Outlook: policy none,GMX: no policy at all) – Steffen Ullrich Jun 2 at 18:45
  • That will certainly help for domains doing things properly, but seeing the posts here I don't have high hopes. – Esa Jokinen Jun 2 at 18:50
2

It is unclear what the actual security and usability requirements are, but if you want to prevent spoofing of the sender you need to authenticate the sender somehow.

This could for example be done with PGP or S/MIME signed mails, although most users are not able to send such mails. It could also be done by fingerprinting the mail client used for sending and/or the transport path and require some other form of authentication when this fingerprint changes (like a reply-mail the user has to acknowledge or a link which need to be visited). One could also require some one time token (TAN) to be send together with each mail and offer the user to load more such tokens once authenticated on the web site.

And one could probably imagine various other methods with different trade offs between security and usability. But again, the actual security and usability requirements here are not clear.

  • Thanks for the suggestions! You seem to want to give me a single answer to a fixed set of requirements, but in my situation I'm just curious about the security/usability tradeoffs here. In terms of most usable, but possibly worst UX, is my sanitization-based approach. I'm really liking @EsaJokinen's verify sender domain, only allow non-spoofable domains (is this actually the case for gmail? I'd love to learn more), which is equally usable, but only for a (large) subset of users. But I imagine your suggestions, like PGP, may be useful for others looking at this question. – VF1 Jun 2 at 18:44
  • @VF1: "You seem to want to give me a single answer to a fixed set of requirements, but in my situation I'm just curious about the security/usability tradeoffs here." - such unfocused problem description with only very vague requirements would make the question too broad. – Steffen Ullrich Jun 2 at 18:49
  • I see. Sorry about that, I'm not too experienced with security, so I posed the question from a position of curiosity mostly (and it seemed like it'd be useful to others). I can revisit this when I have concrete requirements then. Feel free to close for now if you prefer. – VF1 Jun 2 at 18:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.