Account Login, 403 - Invalid login link

[theksp]

I had an account which used to work absolutely fine.

Last few days I have been trying to open the email URL but it says:

403 - Invalid login link

The login link which you are currently using is either
expired or invalid. Please enter your e-mail address
again to receive a new login link.

Start over

So what happened to Keybr exactly?
Do I need to create a new account again ?

[aradzie]

Your account is safe. Please go to the account page http://www.keybr.com/account and enter your email address again. You will receive a new, good login link instead of the old, bad link. I am sorry for the inconvenience. I had to change links to fix a security issue. - Alex

…

On Sun, Oct 1, 2023, 13:35 theksp ***@***.***> wrote: I had an account which used to work absolutely fine. Last few days I have been trying to open the email URL but it says: 403 - Invalid login link The login link which you are currently using is either expired or invalid. Please enter your e-mail address again to receive a new login link. Start over [image: image] <https://user-images.githubusercontent.com/143815103/271825339-669fc3ba-bf1f-4493-817b-f9423804946c.png> So what happened to Keybr exactly? Do I need to create a new account again ? — Reply to this email directly, view it on GitHub <#26>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAAK2YQHWUCS52XFT3C34BLX5FIPNANCNFSM6AAAAAA5OIIWOI> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[theksp]

Thank you for the reply.

I entered the same email address again and I got the refreshed login link again.
Even I continued where I left. Everything was fine.

But today I entered the refreshed login link again and I got the same error that I reported here earlier.
So what I did was, again enter the same email and I got a new login link.
Now it is working fine but I doubt if it won't work again !

[yash-fn]

I think you should implement password option if not too much trouble to do. for people with password managers (like safari icloud, google password manager, etc) the password is actually easier than having to grab a link from email. But not sure how much complexity this adds to app, so ignore if beyond.

[aradzie]

Not too much complexity but an extra obligation to prevent the passwords leaking to the hackers.

Many online services that use passwords still require you to validate your email by sending a link to you. They force you to have both a password and a working email. We only need the latter.

And there is always an option to login with Google/Facebook, etc.

[theksp]

But today I entered the refreshed login link again and I got the same error that I reported here earlier. So what I did was, again enter the same email and I got a new login link.

I still didn't get the answer. I am still getting the error.
I think it has become the case like for every login I have to enter my email, then it will give some login link.

Earlier I could save the login link and I could login through that login link.

[yash-fn]

could just be that every time he updates the app it necessitates a restart that flushes all the account caches. Don't know, just speculating. But could be that.

[aradzie]

Previously those links were permanent. Once generated, they never changed. This is convenient for the users, but unsafe. The links started leaking to the internet (I don't know how). Anybody could steal your account with such a leaked link.

It is more safe for the links to be temporary. Now they expire after a few hours. You have to generate a new link each time you want to login. However, even if the link is leaked, it will make no harm, because of its short life span.

[theksp]

Yeah, like you have said earlier it was convenient for me to login as it was a permanent link.
But it's also true that it could be unsafe. And about that password thing you are are also right about the hassle of maintaining it.

So from now on we just have to keep our email safe:grimacing:, instead of that login link.
Nice touch about the security. Thanks anyways concerning about our privacy and security!

Also I did not pay proper attention to it before as it is mentioned in the login page.

[aradzie]

I changed that text quite recently so it's totally fine if you haven't noticed it.