AccessURL

Share access to accounts without sending a username/password

21 followers

Share access to accounts without sending a username/password

21 followers

Safety and Privacy platforms

•

Chrome Extensions

AccessURL is a chrome extension to share account access.

Launch tags:Web App•Chrome Extensions•Tech

Launch Team

LoomShow, don't just tell with Loom

Promoted

Valentine Roulette

Finally a useful Chrome extension! ;) Missing one small feature:

Report

10yr ago

Covy

Maker

@yefim I should build that!!

Report

10yr ago

@yefim this is likely to be impossible (at least 100%) sure the link can expire but nothing prevents the receiver from saving the cookies for later :/

Report

10yr ago

Covy

Maker

@lasserafn chrome extension could mitm sites using access URLs via webRequest API and then the only way to get the cookies yourself is to use Wireshark or Charles w/ trusted self signed cert, but yeah not 100% solution. The 100% solution is probably a proxy, which has other issues (streaming netflix through a proxy is bad)

Report

10yr ago

@lasserafn @yefim That's right - it is an easy to use tool but you cannot call it secure. Also if the web app you login allows this it is a high chance that it is open to cross site scripting and csrf attacks. Still good job! Looks like you turn a trivial hacking method to something enjoyable, at least for some folks ;)

Report

10yr ago

@fuater @lasserafn @yefim as long as we send it to non-techies I wouldn't see it as a big problem . A really cool idea!

Report

10yr ago

This is a great idea, but many services are moving from cookies to JSON Web Tokens. Do you have plans to account for JWTs?

Report

10yr ago

Covy

Maker

@hankandre Probably someday! Thanks for the feedback.

Report

10yr ago

@jarredsumner For sure. Thanks for building such an extremely useful extension!

Report

10yr ago

Api to bot

@jarredsumner @hankandre JWTs are saved as cookies in general , so this should work perfectly fro JWTs tooo

Report

10yr ago

Covy

Maker

@sanath_p @hankandre TIL!

Report

10yr ago

Re:amaze

I'm always concerned about sharing accounts with others (even family members) but it seems unavoidable. Am I able to set the ETA to expiration?

Report

10yr ago

Covy

Maker

@davidsfeng Yes, the link will stop working in either 24 hours, 1 week, or indefinite -- and it defaults to 1 week. It prompts you to choose before you create the access URL. You can delete the access URL at any time by going to https://accessurl.com/manage-urls

Report

10yr ago

Re:amaze

@jarredsumner Ah sweet. URL manager is a good touch. How will you be monetizing this potentially? Is there a limit to usage?

Report

10yr ago

Covy

Maker

@davidsfeng I have no idea how I will monetize it. Maybe it turns into a B2B Password Manager for teams? There aren't any limits right now, except like a filesize limit on the screenshot and this is currently hosted on 1 digitalocean box...which hopefully won't get overloaded

Report

10yr ago

Re:amaze

@jarredsumner There are likely interesting niches you can explore that go beyond pw management. I might use this to demo some of our product's features using actual accounts now rather than pure demo accounts. Thanks for building this!

Report

10yr ago

Covy

Maker

@davidsfeng that's an interesting idea! I hadn't thought about that

Report

10yr ago

v. elegant solution & solid product history under @jarredsumner's belt give this man lots of twitter follows+money

Report

10yr ago

Covy

Maker

@davidryalpug 💰💰💰

Report

10yr ago

@jarredsumner did you ever meet that other thiel fellow 'kid' who was working on next-gen holograph/hologram stuff? i helped judge some thiel event in SF and it seemed likely he would get swept up by In-Q-Tel (💰💰💰)

Report

10yr ago

@davidryalpug @jarredsumner is the man! +1+1+1

Report

10yr ago

Covy

Maker

@yanismydj @davidryalpug <3

Report

10yr ago

This is a good idea but should work P2P and not hosted on your website. you're making yourself a goldmine of accounts for hackers. I think there are better ways to implement it without going through your server.

Report

10yr ago

Covy

Maker

@danr_4 I'd love to find a way to make it work P2P. Fortunately, all session cookies are encrypted before reaching the server and the server never gets sent the password (not even in the logs). That means if someone did manage to get access to the database, all they'd get is a bunch of encrypted data without a way to use it. It also doesn't keep emails or any other personally identifiable information. It'd be really hard for a hacker to do anything at all with the data (or me, even)

Report

10yr ago

@jarredsumner you're right. it's a good implementation, but still vulnerable to brute force attacks. I'd use a longer password (26+ chars) as it won't hurt the UX but it will immensely help against brute force attacks. But wait a second, how do you know which password is for which cookie when the only data you are passing (through the url) is the password? You can also use WebRTC to send text messages, and instead of the password being an encryption key, it could be a user identifier, and your servers sends the users details to each of the peers to create the WebRTC connections.

Report

10yr ago

Covy

Maker

@danr_4 yeah I may increase the length of the password later. It passes an ID of the session too -- and that is what gets read in from the server to know which encrypted cookie the client should receive. That ID is just a random string though (not the password) Another thing is that these are session cookies, which often expire -- and the access URLs by default expire too. These things make it additionally more challenging from a security perspective for an attacker to make any use of this

Report

10yr ago

Covy

Maker

@danr_4 webrtc is a good idea The challenge there if I remember correctly how it works, is that then both browsers have to keep the page open for the other user to get access. That's a worse UX :(

Report

10yr ago

@jarredsumner yeah but you just need to open a connection to pass the cookie as a (possibly encrypted) text message, then you can close it. so your extension launches a local web page (or even embedded in the extension window itself), you enter the user identifier, wait for a connection from the initiator, pass the cookie, and there you have it. Just a suggestion. But this is really great, I often find myself in a situation where I need to give someone access to a sensitive site for a short time. Will use this. EDIT: saw it takes a screenshot of the page I'm sharing. that's a bit creepy. I don't see me using it without an option to NOT take screenshots. instead there could at least be an option to have your server screenshot the homepage instead of capturing the page I'm on.

Report

10yr ago

Very cool! Such an obvious and much needed tool - I'll be a big user. Are there any risks or concerns sharing the cookie with someone who is already logged in and cookied for the site? (Ex could their session start storing data from multiple accounts, which might cause an issue if anything gets persisted to the backend)

Report

10yr ago

Covy

Maker

@edholloway that's a great question, and the honest answer is...maybe? I think most sites tend to store important stuff in the backend and stuff that's less important on the client. The goal here is to make it work really well for the most popular sites people use this for, and it seems like it does, so far.

Report

10yr ago

PokeSocial

Useful tool. An option to select the time period over which to give access would be an advantage. Nicely done @jarredsumner

Report

10yr ago

Covy

Maker

@codeslayer1 I want to do that but I built this in 1.5 days so I didn't really have the time to add that in yet. I made it so the Access URLs themselves expire by default within a week though.

Report

10yr ago

PokeSocial

@jarredsumner Cool. I guess it will evolve with time. Its really good for 1.5 days effort.

Report

10yr ago

Covy

Maker

@codeslayer1 thanks. It'll evolve w/ time :)

Report

10yr ago

1 2 3