What would be a security risk for a website feature that allows you to connect to your account without typing your password, given that you allowed such a login for the next say 10 seconds from a second secured device of yours.

A simple use case is that your are trying to log in from an unsecured pc. You do not want keyloggers accessing your keystrokes, but you still need to gain access to your account on that insecure location.


2 Answers 2


Attackers knows all about automation. Ten seconds are a lot of time for an attacker who knows how to write scripts. In your scenario, if the insecure PC is malicious, it can use this very small window to enact a lot of harm: contrary to a human user, the attacker is not limited to how fast he can move a mouse.

I suppose that you want to login with your smartphone, and, from that smartphone, allow access to your account for "ten seconds" from the possibly malicious PC; the idea being that you do not want to type your precious password on that PC. This will indeed be beneficial to you if you assume that the PC just passively grabs passwords, but will not actively connect to whatever Web site you wish to use. Not all attackers can be trusted for being so polite, though.

Another similar but much more common and robust solution is to use one-time passwords. Instead of opening your accounts to everybody, even for a short time, use a password which works only once. Key loggers can log it, it won't matter, since the server will not accept each password more than once. You still have all the issues with maliciously active insecure PC: once you accept to use the bad guy's machine, you are giving him, virtually, access to your account for at least the few seconds you are using it, and that's enough to forfeit your security.

  • the thing about one time passwords is that they are more complicated for the user to type it in. I am looking for an easy solution to encourage the user to never type in their passwords except on their secured devices.
    – M.C.
    Aug 26, 2013 at 15:18
  • But how can an attacker know when the user activated this feature? An Attacker would have to try to connect to all accounts all the time
    – M.C.
    Aug 26, 2013 at 15:20
  • The connection to the server comes from the machine that the attacker controls. He can simply keep track of every connection to a given server; if he sees one, boom, there he goes.
    – Tom Leek
    Aug 26, 2013 at 15:27
  • Also, on my own server I receive hundreds of connection attempts per day, from attackers who just try their luck. This is also easy for attackers.
    – Tom Leek
    Aug 26, 2013 at 15:28

The better option is to produce a temporary password that can be used on the secondary device. Make a one time use password that is valid for 5 to 30 minutes. Any time left unsecured could be exploited, particularly if they are able to monitor the IP of a connection and thus make a guess about the user.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .