1

I'm not sure how to phrase this so I'll just explain my scenario and hopefully you can help.

I have to create a site that will have 50-100 students all selecting courses they would like to take for the next semester. As each student ideally should only be able to access the site for a week, I was considering generating a key and emailing the key to them. This key would be 8-10 alpha-numeric characters kind of like: 8fgea2awde. The key would be stored in the database with an expiry date linked to the users account. Then once the user logs in with their key a secure session is created and authenticated while they are logged in. I know it's not very far from the username & password approach.

I know Oauth exists, although I have no idea how it works. Ideally I wouldn't like to "roll my own" security, I'd like use a third party but I'm not sure how that would fit into my situation.

I was wondering if this was a good approach? Do you maybe know of a better or more widely used approach?

You'd be saving me a lot of hell.

Improve this question
7
  • What's keeping you from using basic HTTP authentication over TLS? What's so special about this situation?
    – Maarten Bodewes - on strike
    May 9, 2015 at 18:42
  • The question is more geared towards is it a good idea to generate passwords for the users and email it to them? Of course I'll force HTTPS. I'm just trying to avoid creating my own authentication system if there is a better one out there. But thanks for your reply!
    – Warosaurus
    May 9, 2015 at 18:49
  • Probably not if you want the students to remember the passwords.
    – Maarten Bodewes - on strike
    May 9, 2015 at 20:55
  • Good point, these are hopefully very random keys but since it's only a week it shouldn't matter, simply copy/paste. That said it's good to control user accounts, such that users can't sign up but instead receive access.
    – Warosaurus
    May 9, 2015 at 21:29
  • If you assume that mail is a secure method of dispersing login info you might as well send a HTTPS link that includes the password so they bookmark it. TLS is setup first so the password is still protected.
    – Maarten Bodewes - on strike
    May 9, 2015 at 22:01

1 Answer 1

Reset to default
0

The question is more geared towards is it a good idea to generate passwords for the users and email it to them?

Reasons not to do this include:

  • It could be vulnerable to shoulder surfing. A user walking past while another user opens their email not expecting a password to be displayed could have their credentials stolen. This is particularly a risk at a college environment where everyone is using the same system.
  • This violates a policy of never outputting passwords. A more secure system only ever has passwords input - stick to this rule and you will tend to find you generally end up with a fairly secure system in terms of password management.
  • Anyone who has temporary access to an email account will be able to grab the password undetected. For example if the workstation is left unlocked for a very short period it will enable a very passive attack where very little evidence of the compromise remains.

A more secure system would email and instead include an link and a cryptographically secure one time code. This will enable the student to follow the link, enter the code (the link and code can be combined with the query string, however this is slightly less secure as URLs are logged by default, stored in history and can be exposed in the referer header) and then set up their own password.

Once the password has been setup, the link cannot be used again, making any later use of the email benign.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .