SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

Passwordless Email Login Has a Hidden Flaw: Loose Inbox Boundaries

0
·1 views

Passwordless email login removes the risk of a stolen password database, but introduces a subtler vulnerability when inboxes are not properly scoped to individual auth sessions. Many teams treat email delivery as a neutral layer, allowing one inbox to collect OTP codes across multiple sessions, environments, or users, which opens the door to replay attacks and code mix-ups. The core problem is not a weak code generator but loose delivery context — codes are often not bound to a specific session ID, nonce, or environment. Security-conscious teams are advised to tie every OTP to a unique auth attempt ID, hash codes before storage, and expire them within five to ten minutes of issuance. Isolating inboxes per automated run or manual review window can significantly reduce ambiguous auth events and improve both security and debugging clarity.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

AI subscribers pay $200 but cost providers up to $3,500 a month, analysis finds

A detailed analysis by SemiAnalysis found that heavy users of AI subscription plans such as ChatGPT Pro and Claude Max can consume tens of thousands of dollars worth of compute at API prices while paying only $200 per month. The real per-user loss after accounting for lower serving costs is estimated at around $3,500 monthly, roughly 17 times the subscription fee. The shortfall is covered by venture and institutional capital betting that today's usage habits will eventually translate into pricing power. Meanwhile, AI datacenter demand is redirecting DRAM production toward high-bandwidth memory, pushing consumer RAM prices two to three times higher and effectively spreading a hidden cost across all computer buyers. The dynamic mirrors past subsidy-driven growth plays like ride-hailing and cloud computing, but at a far larger multiple.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Hasura Kubernetes manifests pressure-tested with Ota v1.6.24 and raw kubectl proof

Developer tool Ota v1.6.24 was used to governance-test Hasura's Kubernetes install manifests, separating local manifest interpretation from actual cluster deployment. The test defined three distinct proof levels: local manifest rendering via kubectl annotate --local, cluster resource acceptance via kubectl apply in an ephemeral kind cluster, and full application readiness, with only the first level confirmed on macOS. Ota's contract explicitly declared cross-platform kubectl installation, safe verification tasks, and cluster-mutating apply tasks, keeping them in separate workflow lanes. Apply tasks were excluded from safe task lists to prevent agents from accidentally triggering deployments during routine verification. The work was deliberately scoped to the install-manifests/kubernetes directory, avoiding broader claims about Hasura's full infrastructure.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer Builds Open-Source Proxy to Stop AI Agents From Overrunning API Budgets

A developer building AI agents for several months encountered a costly failure when an agent entered a loop, making repeated API calls that inflated the bill without any obvious crash or error. The incident prompted them to create SpendGuard, an open-source proxy that sits between the user and the agent to enforce spending limits. The tool can cut off mid-stream calls once a budget cap is reached, detect and break repetitive prompt loops before calls are sent, and block specified tool calls such as delete operations. SpendGuard runs locally and requires no account signup, and its code is publicly available on GitHub. The developer is now seeking community feedback to determine whether runaway agent costs are a widespread problem or an isolated personal experience.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

How a Spring @Transactional Misuse Exhausted Database Connections via External I/O

A production incident traced a Hikari connection pool exhaustion to a Spring @Transactional method that enclosed synchronous calls to external systems like ActiveMQ, Firebase, S3, and SMS. Spring's default event listeners run synchronously on the publishing thread, meaning JDBC connections stayed checked out from the pool during network round-trips to the message broker. When the ActiveMQ broker became unavailable, every write request stalled on the JMS send, preventing transactions from committing and draining the pool entirely. New requests then timed out after 30 seconds, surfacing as SQLTransientConnectionException errors. The root cause was a code pattern where database transaction boundaries incorrectly enclosed calls to external systems that the database had no visibility into.

0 comments Read more at DEV Community
Passwordless Email Login Has a Hidden Flaw: Loose Inbox Boundaries · ShortSingh