Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

Hy Hello all, I have an idea to implement but I hate to copy if it is been used by any other website(s). My idea is about suspending an account using text SMS. The description follows.

When a user signs into his account he gets an text SMS saying "Hello Mr.X you have been logged into your account from IP xx.xx.xx.xx, If you are not the real user logged in send reply to this as BLOCK<space>15<space>random code.

So, here the user can suspend his account by sending a return SMS as BLOCK 15 to block his account for 15mins. This text SMS can terminate the user session and does not allow him to login for next 15mins even with correct username and password. Likewise he can suspend his account for any value of time and can release the same by sending UNBLOCKrandom code. Is this kind of feature used by any website? Please let me know if it is used. Else I wanna be the first person to implement it.

share|improve this question
1  
I don't see the question here. If this is your requirement then just implement it. –  ChrisF Aug 8 '11 at 17:44
add comment

closed as not a real question by DisgruntledGoat, John Conde Mar 3 '12 at 2:41

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

2 Answers

There are some attractive aspects to your implementation, however, it fails to meet the most basic security requirement: by default, do not allow unauthorized users access.

A "do you want to ban whomever logged in?" query assumes that, by default, the user is not banned - an ignored SMS means that the unauthorized user had access to the account.

The better default: send an SMS whenever a login is attempted from an unrecognized host and require that the authorized user enter a code from the SMS to complete the login process (this process has the added benefit of preventing an unauthorized user from accessing the account while notifying the authorized user that someone is trying to log in).

Gmail, for one, implements SMS in this manner.

share|improve this answer
    
Thanks for you reply. Lets talk technically, a script can detect user's IP address which can be masked using hide IP then their system name which can be modified before hacking. So, how to detect who is an authorized user and who is unauthorized? –  Karthik Malla Aug 9 '11 at 4:05
    
Okay. What in case of cookie steeling? My code can prevent cookie steeling too. –  Karthik Malla Aug 9 '11 at 4:06
    
If you are forcing use of SSL (if you are concerned with security you should be) an attacker will not be able to see any of the information in question to prepare a forgery. –  danlefree Aug 9 '11 at 8:49
add comment

I've never heard of it being used. It sounds like a good optional feature for high risk websites, such as Poker Websites, Bank Websites, Stock trading sites etc where large amounts of money can be drained relatively quickly.

However for most applications it's probably overkill and will increase the amount of time you will spend doing support for people who don't quite understand it etc.

Be careful about guarantees as well, if you offer this service, someone gets hacked the SMS doesn't send/is delayed then you may be liable for any theft/damages.

Good innovative idea though in my opinion, but too risky/overkill for 99.99% of people. Those 99.99% of people should just invest that time in making sure their systems are really well implemented and secure.

I suggest to you to make a technical demo and write about it, how you implemented it, what pitfalls you have found, it could make for a really interesting and popular read.

share|improve this answer
    
Thanks a lot Tom. But as you mentioned that this is too risky may I know what the risks that strikes your mind? –  Karthik Malla Aug 9 '11 at 3:58
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.