Is sending authorizing links through e-mail a vulnerability?

Question

I am not sure if my wording is right, but if I attach a unique token inside email links which will authorize the user if clicked, would you consider this a vulnerability?

Password-reset partly includes this. That link authorizes you to reset your password, but here I am talking about a more long-lasting link.

I have no particular implementation in my mind currently, but I always have thought entering credentials after clicking a link is a cumbersome process.

That way we lose the ability to mass-email the exact same email, and maybe the vulnerability occurs if we use an external mass-mail service (like most probably), or the receivers mail setup allows sniffing somehow.

Has anybody weighted ups and downs?

Answer 1

The problem with this is that in current practice, e-mail is not really a very secure channel to send this sort of information. There isn't much of a way around this, short of convincing the overwhelming mass of humanity to drastically change its e-mail habits. That's probably never going to happen, so we have to live with it as best we can.

If an "authentication" link expires after a short time, then the risk of a leak is minimal. It is very unlikely that anyone will get into the e-mail account between the time the e-mail is sent and the time the user sees it. It also helps if, once the link is clicked, it immediately expires, because this makes the window of opportunity even shorter.

For such purposes as password resets, this is typically considered "good enough." In these cases, the window of opportunity for an attacker is very short, because the user had to deliberately trigger the link's creation, and we told him to check his e-mail. Chances are, he'll check it and click the link within minutes. That's what we want.

But the longer that link stays active, the greater the risk that someone else will see the link first. If they use it, you're trouble, because you have no way to know that this is not the user you intended the message for. That's the security-based reason why it's not a good idea to use a long-term authentication link.

There's another, more pragmatic reason: how will the user remember which link to use? If the user has to memorize or type his own authentication URL, that's at least as difficult to use as a password, plus the user will need to type it into places where it won't be hidden. If we rely on the user to make a browser bookmark, then as soon as the user has to deal with multiple machines (barring browser sync mechanisms, which present their own problems), the bookmark gets lost. If the user has to go through his e-mail each time he wants to log in, that's another user/pass dialog to go through, and even though it's not one we have to worry about, we still haven't saved the user any time.

Answer 2

You should not have an e-mailed link used for long term authorization as it will likely become compromised over time and the user has no good way to know if it was leaked. The point of sending a password reset link is that the user will know if they lose access to their account and the reset can only be used once.

If you want someone to be able to be authenticated when clicking a link in an e-mail, you should use SSL to exchange a session cookie and then use that session cookie for authentication Since the cookie is exchanged securely, it would prevent a third party from gaining access without first compromising the client.