Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

Just posted a new plugin: No More Passwords

I currently have it tagged beta because logging into a platform is a sensitive issue and I don't want to release something that may have security holes. So here's my query:

Is is secure?

I've done the following to ensure security:

  1. Username/password are never passed back and forth, only the unique hash.
  2. Hash is removed from the database once it’s used, old hashes that haven’t been used can’t be unless the database is hacked, but then you have bigger issues.
  3. All database queries of the hash have been escaped to prevent XSS attacks.
  4. nonce added to ajax call.
  5. nonce and confirmation added to on mobile end to prevent CSRF attack.

Here I have a complete description of how it works.

Next version I hope to implement oauth via twitter, since iOS now has it worked in...

Thanks for your input in advance.

Edit: I decided that as an added layer I would add a sessionID check to make sure that it's the same browser logging in as the browser that initiated the QR code login.

share|improve this question
add comment

2 Answers 2

(I'm a sucker for alternative login schemes)

Some nitpicking regarding DB escaping:

  • You use mysql_real_escape_string() directly. The preferred method is using $wpdb->prepare() or esc_sql().

  • UPDATE queries are best handled by $wpdb->update()

share|improve this answer
    
I'll work that in. Thanks! –  jackreichert Jan 30 '12 at 2:58
    
I've updated the plugin to include that. Thanks for the tip. –  jackreichert Feb 2 '12 at 2:28
add comment

I think it's a great idea but like always the biggest weakness is the human factor, in this case it would be the phone itself being lost, stolen or intercepted. Have you thought about adding 2-layer authentication, like an SMS verification code ( like gmail, etc). Or an alternative that is easier would be a cookie + secret word.

Also can you mention what algorithm is generating the QR code in your about page?

share|improve this answer
    
So the plugin relies on you being logged in on your phone to work. The security risk of you losing your phone is about the same as leaving your pc logged into your wp site. I'm using google's chart api to generate the qr code. –  jackreichert Jan 30 '12 at 3:00
3  
I just thought it would be a good idea to add another layer that would not hinder the user, since phones get stolen/lost a lot more than pc's, and on a pc you would still need to know the username/password. –  Wyck Jan 30 '12 at 15:22
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.