Security issues if not forcing a user to sign up

Question

I've built a simple web app Flask.io that enables users to create and share to-do lists.

It doesn't require sign up. This is an important differentiator. I don't want to force the user to register for a tool they haven't used yet.

How it works is when they create a list, a random slug is generated and they are redirected to that unique url e.g. flask.io/random-slug

My question is what security implications are there?

Removing sign up should improve the on-boarding UX, but is it worth it in exchange for a not as secure system, and should I introduce registration further down the flow?

The random slug is 5 characters long. Would love to know your feedback especially if any experience here.

Answer 1

I do agree with the security concerns being posted here, but there still may be a market for such an app. I think a good use case for an app like this is for a shared task list - there are a lot of ways to build a shared to-do list, but all of them require at least a registration if not a download of some type, and it's a pain.

So, I'd say if you're going to keep it registration-free, then it would be pretty critical to provide some kind of warning to the user that their list is essentially public; maybe some kind of "I agree" consent form. You could even brand it as public, and offer registration as an additional, "private" tier of lists.

As long as users are aware of the risk that having a public to-do list entails, I'm sure there are plenty of people that would be okay with sharing their list with the world. Now getting users to read and understand your warning and NOT put sensitive information out there...that's certainly a challenge.

Answer 2

I have a lot of experience with task management. Tasks are extremely personal, and need to be treated as such.

A task list can consist of sensitive information, either explicitly or implicitly. For example "call bank re: loan refusal" is more than I want anyone to find out, and "call Dr Smith" could reveal that I'm seeing a medical specialist when I don't want that to be known. This isn't even beginning to skim the surface, this is only assuming a single line. If there's additional task information (say, a URL or notes), then the risk for revealing sensitive information is that much higher.

A five-character string is trivial to hack via brute-force, thus inadvertently revealing that sensitive information.

Answer 3

It's a security and privacy risk if you allow anyone to see a todo list without being sure that you are showing it to the right person.

While it is a good idea to let a new potential customer use your software without first signing up, it is not a good idea to let them access it later on with nothing more than a short slug

There are two ways that I would consider handling it.

1. Use a cookie and place a long code in the cookie to identify the person.
2. Offer a demo without signing up. When they are creating their list in the demo, make it clear to them that to protect their privacy, if they want to save their list to use later, they will need to sign up for an account. Make sure that if they sign up though, that the list they have created in the demo is now in their account.

I would go for option 2, as the first option is likely to cause more support issues, and many people have cookies turned off.

Answer 4

Agree completely with nadyne. It's not so much brute forcing the 5-char ID (which implies that you don't know what the ID is and you're trying to find it).

It's more along the lines that a determined attacker with scripting skills and a small botnet can enumerate your entire task-space, and collect every single active list, and can continually re-visit areas to see what changes.

I would suggest some additional method to identify the original user. e.g. Allow the list to be created, and then require an email address after say, 3 items. So that on a re-visit, the user has to enter their email address to see the list.

Answer 5

First of all 5 characters are fairy easy to brute force and one can copy all your lists very easily and do whatever they want with them.

A better solution would be:

1. No signup of course, user goes straight to their URL and you attach a cookie to their browser to identify them without requiring pin for them(explained below).
2. On the list page display a banner that says "Set a pin and make your to do list private. Even if you share them with others they will have to put the pin you set".
3. If they think their information needs protection they will set a pin and URL along with the pin will act like a username-password combo which is less likely to be hacked.
4. The pin can even be 4 numbers (easy to remember) and you can restrict the brute forcing of pin in your backend.