2

Is there any risk to an Activation Email?

My ASP.NET Site is set up so that a user has to check their Email and click an activation link which is made of a GUID created as their user ID in the SQL Membership Tables.

There is a third party application that holds an Email, a not so secret 4 digit ID Number for each potential user, so the user must use this Email and ID together in order to register an account, the account is not "approved" until they activate their account using the link in the Email sent to this Email. only employees can set the Email and ID in the third party application.

This site handles signing up for an Email Subscription of semi-privileged information, this site doesn't actually handle the emailing of the semi-privileged information.

Other than Social Engineering, what is the risk associated with this set up for user registration?

2

Using only their username to generate the GUID is not sufficient, how about adding a time stamp to it?

There should be a time limit to which the user has to click the link. The link should also expire upon account activation, especially if they are required to set a password upon account activation.

What if I am able to obtain the activation link, is the four digit code protected by some sort of rate limiting? This in order to prevent the 10000 requests to guess the four digit ID.

  • The Four Digit ID is linked to a specific Email and will only allow that Email and ID to create an account and be sent the Activation Email. if the user wishes to use another Email address they will have to talk to a real life person to get it changed. so should they guess the ID and the Email it belongs to they need to hack the email account or catch it in transit as another answer states. but the Time stamp being added to the Guid is a good idea – Malachi Dec 19 '14 at 21:49
  • the username doesn't create the GUID though, at least I don't think it does, this part of the SQLMembershipProvider built into SQL Server and ASP.NET so I don't think that they would have it be created based off just the username, I believe it is a random GUID and not Based off anything. – Malachi Dec 19 '14 at 21:51
  • 1
    If your using an activation link for when the email is changed (which you should), have the activation code be reset if the user logs in with the old e-mail. An email should also be sent to the user every step of the process, including when the account is activated. – ub3rst4r Dec 20 '14 at 1:55
2

The main problem is that e-mail is not a secure distribution mechanism and is potentially susceptible to intercept. It is unfortunately often the best we have available for trying to validate a user has access to the e-mail box, but shouldn't be trusted exclusively.

Many e-mail servers make no attempt to protect the contents of an e-mail in transit and any computer or router in the path of the e-mail can read the messages. Anyone with access to that path, either through being an ISP or through a virus on the users computer could access the contents of the e-mail.

Additionally, unless the e-mail goes to an SSL secured website, it would be possible for an attacker to spoof the page and intercept the GUID on the way back to your server as well.

Most likely the user will be the person who actually owns the e-mail address, but you have no guarantees of that.

  • I should have included that the Site makes use of SSL. – Malachi Dec 19 '14 at 21:44
2

"How secure is X" is always a vague question. In order to give you a better answer, we need to understand the value of what you're trying to protect, and your threat model.

Are you trying to protect a banking or shopping site, where people can store credit cards for future purchases? You'll have determined thieves like you can't imagine, and this isn't nearly adequate. You likely have more security issues than the few paragraphs of advice you'll receive here.

Are you trying to protect a shopping site, where people can browse, set up wish lists, fill shopping carts, and write reviews; but don't pay on your site? What do you think the hackers might find valuable? Could they re-route purchases to some other location where they'd be stolen? It might be OK, but you should think about incorporating another factor, such as a security question, SMS message, requiring a physical visit to a cashier, etc.

Are you trying to protect the comment section of your blog, and your primary concern is an army of smurfs posting spam-filled links? It should be adequate.

Are you posting a private gallery of pictures for friends and families? It's probably overkill.

Think about your perceived threats and vulnerabilities, in terms of attackers and their motivations. Then come back here and clarify your problem statement a bit more, and improve your question. If you haven't already figured out the answer on your own, we'll still be here.

  • 2
    This seems like a really long Comment... – Malachi Dec 19 '14 at 21:46
  • True - but John has very valid points - without all this it is very difficult to answer your question. – Rory Alsop Dec 19 '14 at 22:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.