So, we have 2-factor authentication, and that’s amazing, but it has two flaws:
- The majority of targets of account theft (newbies) don’t use 2-factor authentication
- Those that do don’t feel entirely safe since our account can still be breached from the angle of cookies
I don’t feel the first needs any more elaboration, but let me expand on the second. I am seriously considering hosting games/etc on a dummy account I don’t use so it can’t be breached via cookies since I’m never logged into it. I don’t know much about web security, so I can never truly feel safe with my account in the knowledge that someone can bypass 2-factor with login cookies.
It’s been suggested to invalidate cookies when the IP changes, but staff members have pointed out that this would be problematic on mobile networks. Users wouldn’t be able to go about their day-to-day activities without being re-prompted to log in every time they changed networks. So long as we don’t interfere with their day-to-day activities though, invaliding logins should be fine, right? For instance:
- Opening games in Edit mode
- Sending trades
- Buying items
- Deleting items
- Configuring assets
- Accessing Group Admin
- Exiling members from groups
The idea here is that anything that can cause irreparable damage should require re-logging in if the user’s IP has changed. It’s a philosophy similar to requiring the user to enter their password when changing their account settings. This won’t be an inconvenience like invalidating logins when only the IP changes because 1) these things typically aren’t regularly done like navigating webpages/posting comments/etc, and 2) even if I need to re-log in, I won’t need to do it again until I go somewhere else and my IP changes. Even if there’s a slight inconvenience, I still think it’s worth it.
The end result is that I can be sure my account is safe from irreparable damage in the event it does get compromised, a major source of account theft (stealing items/money) is immediately thwarted since this would be applied to all accounts, and any sort of account theft is now very unrewarding.