0

I have had multiple security researchers tell me that the best practice when a user changes their email in settings is to logout all other devices and force them to login again.

Nobody has been able to explain what attack this prevents or how this helps protect users.

On password changes:

  • I require re-entry of the password
    • If an attacker has a stolen session cookie, they shouldn't be able to change the password.
  • I do force all other devices to login again
    • If an attacker knows a victim's username/password and a victim changes their password, we don't want the attacker to remain logged into the victim's account.
    • If the attacker has a stolen session cookie, we want it to invalidate it.

On email changes:

  • I require re-entry of the password
    • If an attacker has a stolen session cookie, they shouldn't be able to change the email.
  • I invalidate any tokens sent to an email (eg. password reset links).
    • If a user changes their email because an attacker has gained access to their old email, we don't want the attacker to be able to use any previously sent email tokens.

If I force all other devices to login again after changing the email. What scenario is this helping protect against?

7
  • Seems like it could make a difference, but it depends on the details of your system. Does it use email as a user name? Does it use email as part of a second factor authentication mechanism or as a means of resetting the password?
    – John Wu
    Mar 18, 2022 at 4:06
  • Email and username are separate. You can't log in with an email address. Two-factor is TOTP only currently. WebAuthn passwordless in testing for future authentication. Emails are only used as password recovery and account alerts / transactional emails. Mar 18, 2022 at 4:44
  • It took me a while to figure out the context you are talking about, i.e. that the user itself has changed their email in the settings of your web application. I've changed your question to make this context more clear. Hope I got this context correct. Mar 18, 2022 at 5:28
  • You should require the user to re-enter their password when changing e-mail or password. That would start a new session. This is to prevent a stolen session from taking control of the account. Remember that a stolen session is not the same as stolen e-mail/password combination. Most sessions are persisted via token these days... or possibly a hash of password for older sites with "remember me" type cookies. Mar 19, 2022 at 17:08
  • @pcalkins I already require the password to be re-entered to change the email or password. I have tried to clarify the question to reduce confusion. Mar 19, 2022 at 17:56

0

You must log in to answer this question.

Browse other questions tagged .