Comment by sriku | Hacker News Reader

Comment by sriku | Hacker News Reader

Parent Full thread

I use a similar technique to this author's on my site (for about 5 years now) but it is a variant where even if someone got the email or you forward it accidentally to someone, they won't be able to use it to login.

Technique described here - http://sriku.org/blog/2017/04/29/forget-password/

... basically when use provides email to signin, a cookie stores a part of the token while the server send the other part via email. Both parts need to be put together and validated for a login to get through. So the link sent in the email will work only in the browser session where the cookie stored at login time is accessible ... which is how it is configured for most of the users of my small site.

Another side effect of this technique is that bad login attempts do not need a database hit to be rejected.

What happens with people using the phone for email but a computer for work?

You can adjust this by simply requiring user to type a code from their email.

That said, if an attacker had persistent access to your email, you’d still be compromised through this method.

Not necessarily. The code could be a part of what's combined with the cookie for the login. And the site could trash the cookie if tried once with an invalid code just as it would replace it with an auth cookie on success. A real attack would be through a programmatic request though. A captcha might help protect from that or you an use a redis instance or whatever to invalidate bad login cookies.

Or you could just use normal generated passwords that are synced between devices in your firefox and never have to bother again with logging in on any device.

A 6 digit code is ok for 2FA. It’s not good enough for single factor auth like this. There’s not enough entropy & it could be brute forced.

Good point. Adding letters would be key.

This is fantastic, I might steal this technique since it's so good.

Reply on news.ycombinator.com