Hacker News Reader

Comment by underwater | Hacker News Reader

A good idea for some situations. There are some obvious caveats:

* Remember email is not encrypted. The links can be intercepted.

* Consider looking at other factors (like IP, browser data, persistent cookies) that will let you know the user is legit before you green light the auto-login.

* Link to HTTPS, not HTTP. The user might be on a shared computer and you don't want login-able URLs left in the history.

* Force the user to enter their password to access sensitive settings or data (like changing email, passwords, etc.)

View on HN

The "click here to reset your password" links are sent over unencrypted email, too. I guess I am being insufficiently clear about why this is no less secure than what exists today.

> Force the user to enter their password to access sensitive settings or data (like changing email, passwords, etc.)

If they have to enter their password to change their password... then how will the "click here if you forgot your password" feature work?

There's a difference between those two features. Changing the password requires entering the old password and entering the new password, so you're authenticating them via their password. Resetting the password requires sending a link to an email account you know they own, so you're authenticating them via their email account.

It's SORT of a "thing you know" vs. "thing you have", except the email account is kind of also a thing you know.

They both change the password, thereby granting access to the account. The security issue is really just the true stupidity of "sending password reset links via unencrypted email" - but it's already the standard so we can leverage that to offer auto-login links at no extra charge.

> I guess I am being insufficiently clear about why this is no less secure than what exists today.

Because it sounds scary really. But if someone aiming to take over an account already has access to the account's email inbox then forcing the user to reset their password immediately is no hurdle, it inconveniences a legitimate user (however briefly) more than a malicious user.

However, I am still not in favour of an immediate auto-login without a password reset beforehand (as there is a need for the user to update their password). Since we've already 'verified' that the user at least has access to their email (so it is probably them) I don't see anything wrong with automatically authenticating the user after this though.

Please don't act as an authority on security when you do not understand how something like a POST request works.

What you're encouraging is forfeiting the site's accounts in standard communication, of which you send many, many more than "Reset your password" emails (which should, but may or may not be triggered by a form that presents at least one security question), and which are fundamentally different than "account security" emails, for the sake of streamlining the user experience, i.e. saving the user from having to log in at all from new devices.

If any users forward any of these mails to anyone else, they've essentially given them complete access to their account--imagine if Facebook started doing that in their "You've received a new message". It's needlessly and inconspicuously compromising account security on a regular basis with no real win. (The idea wouldn't fare well in a proper risk evaluation.)

I wish I could up vote this all day.

This my first thought upon reading the article. If people designing websites are making decisions that are not really well thought out (like this), episodes like Sony will continue to happen.

It really makes me sad.

It also makes me angry.

change password shouldn't log you into your account, just provide a form to enter a new password.

Yes, it should.

I can just set a new password and then log in with it anyway. Don't make your users jump through hoops.

That's true but with reset password links you can force the user to do extra work, like enter a CAPTCHA or answer a secret question. That should prevent bots from scraping and compromising accounts on a large scale.

Remember email is not encrypted. The links can be intercepted.

This is somewhat false. You should clarify your intention here.

Whoever downvoted me is apparently unaware of encrypted protocols like SMTP w/ TLS (which most major webmail providers use) and IMAP (which is increasingly preferred over POP3).

IMAP is an unencrypted protocol (as well as SMTP and POP3) in the same regard that HTTP is not HTTP + SSL. All three mail protocols can be wrapped nicely inside SSL/TLS, but it is only point to point encryption.

If I connect to my SMTP server over TLS and send you a message to your server, I cannot guarantee that your SMTP server is listening on the secure ports, let alone serving IMAP or POP3 over SSL to your client, which can be intercepted. Never mind the fact that 45%+ of all mail servers are storing these messages in plain text in /var/mail/

This is true, but most major providers only offer IMAP over SSL IIRC.

True but once again I think all the major email providers use SMTP over SSL.

Reply on news.ycombinator.com