“Login To Simplenote” Email – Security Concerns
-
The Login To Simplenote Email states the following: “If you didn’t request this email, there’s nothing to worry about, you can safely ignore it.”
Shouldn’t this be the opposite sentiment? If I didn’t request login via e-mail, I would be VERY concerned.
E-mail login seems like a “convenience” that reduces security.
-
Hi, thanks for this feedback! Login via email has become an accepted standard recently, largely because it makes the authentication as secure as your authentication to your email provider (which is, one hopes, very secure). Unlike passwords, which tend not to be rotated, the codes have a limited time during which they are valid.
The email is correct that there is nothing to worry about, for two reasons. Firstly, it is generated by simply filling in an email address, and is not therefore an indication that the account has been compromised or that anyone else knows the password. Secondly, the authentication attempt cannot succeed if you do not share the code or click on the link from the email. So no one is able to access your account if they cannot also access your email.
I hope this helps! Let us know if you have any other questions or ideas about how to clarify that wording.
-
Thanks for the explanation. While we (of course) hope that e-mail login is very secure, reality can be very different. The “nothing to worry about” message still seems to be dismissive of a potential problem that one should investigate (e.g. reviewing login activity on said email account). I’m not sure what text would be better; this is clearly something of a philosophical discussion. Always challenging in the security realm.
I appreciate the product and have been a long-time user.
-
Yes, we always have to thread the needle between providing necessary information and reassuring folks who might worry that they have been “hacked”.
Most cases that generate an unexpected login request are honest mistakes, such as typos, or a known person logging into a shared account. But I agree there ought to be a way to flag these if something seems suspicious.
In the future, I’m hoping we can add a Settings page to manage authentication methods and review/manage active sessions across devices. Without the ability to disable the password on an account, email-based login is obviously more of a convenience than a security upgrade (as you say, it’s an assumption that the email is more secure; and anyone with an insecure email password is not likely to set a strong password on their Simplenote account), but it’s a first step in modernizing the authentication system.
Thank you for your kind words and for sticking with us for all this time!
Simplenote Support Forums 