2

The only one I can think of would be if someone exports a backup of their inbox and doesn't encrypt it for some reason. Other than that, is there any case where someone could read your emails from days ago, but not within the past hour?

For context, the reason I ask is that some people think that email tokens should expire. That's completely useless because the attacker can just email a new token, unless he can only read older emails.

  • 5
    I'm glad that you've added the relevant context to your question so that one can understand where the questions comes from. Based on this your question is based on the assumption that the only way a link with a token can leak is by having access to the mail with the link. But if the link was used, it is likely inside the browser history and some server logs. Also depending on the link it might be possible to brute force it. Having the link expire limits this attack vector. – Steffen Ullrich May 10 at 20:39
1

Even though I am not aware of an explicit exploit, I would draw a different conclusion. Anything that is security related should expire, because you can not know what will be possible in the future and because a token is a form of credential.

Here are some more reasons I would take into consideration, other than the (personal) backup.

  • Most important, reusing an old token would be complete non-detectable for the legitimate user. If the attacker must send a new token, at least the user has a chance to get a new mail notification etc. (I am aware of at least one real incident where a user has informed the IT department because of suspicious notifications on their phone for mails they could not find in the inbox - the attacker delete the mail right after they copied the data needed).

  • Mail is usually stored and forwarded a lot between servers. Thus besides the personal backup you need to consider that the the mail was at some time stored on any of the involved mail servers, maybe even backuped.

  • Your mail has passed most likely through several spam filters along the way and this be process by systems you might not be aware of.

  • Someone might have recorded a LAN/WIFI transmission where your mail was not encrypted (plain SMTP).

  • Once used, the link can show up in the browser history, even synced to other devices as well.

So while it seems to be hard for an attacker to target a specific user through old emails, there are still several attack vectors for abuse of the token for any user of your system.

In the end, you will have to check it against your threat model.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.