Skip to content

Conversation

@susnux
Copy link
Contributor

@susnux susnux commented Apr 18, 2023

Summary

Add some metadata like the IP address and the browser type to the password reset mail for fraud detection.

Screenshots

before after
image image

Checklist

@susnux susnux added enhancement 3. to review Waiting for reviews labels Apr 18, 2023
@nickvergessen nickvergessen requested review from come-nc and szaimen and removed request for MorrisJobke April 19, 2023 05:25
$platform = $this->l10n->t('unknown');
}
$emailTemplate->addBodyText(
htmlspecialchars($this->l10n->t('Security notice: This password reset was requested from following IP address and browser: %1$s (%2$s).', [ $this->request->getRemoteAddress(), $platform ]))
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would rephrase and reorder this information

Password reset

A password resset was requested from %1$s (IP address) and using %2$s.
If you have not requested the password reset, then ignore this email.
Otherwise, click the following link to reset your password.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I have added that additional paragraph because of this comment: #4345 (comment)

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So I checked all reset password emails in my inbox and most of them did not have information like this.
But if they did, it was the first information given.

cc @jancborchardt for your 6y old comment

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

also cc @nimishavijay :)

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As per GDPR officer we can not do this:
#37808 (comment)

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Then closing :)

@szaimen szaimen removed their request for review April 19, 2023 22:32
@szaimen szaimen added this to the Nextcloud 27 milestone Apr 19, 2023
@come-nc
Copy link
Contributor

come-nc commented Apr 20, 2023

Stupid question maybe, but is there no data privacy implications here?
This is sending the IP and browser of a web visitor to another person by email. I understand in this case it’s the web visitor’s fault for entering the email address of someone else but laws may not be that precise?

@tobiasKaminsky
Copy link
Member

It is. Server is processing ip address and thus user must be informed prior to it.
(other services, e.g. Google go even further and try to locate ip address, to give user a better info where the login attempt was done, e.g "user tried to log in near Frankfurt")

As far as I know we do not ship by default such an information, so I tend to not include this at all.

This was referenced May 3, 2023
@skjnldsv skjnldsv added 2. developing Work in progress and removed 3. to review Waiting for reviews labels May 9, 2023
@skjnldsv skjnldsv modified the milestones: Nextcloud 27, Nextcloud 28 May 9, 2023
@skjnldsv
Copy link
Member

As per GDPR officer we can not do this:
#37808 (comment)

@skjnldsv skjnldsv closed this May 11, 2023
@szaimen szaimen deleted the feat/4345 branch May 11, 2023 08:38
@susnux
Copy link
Contributor Author

susnux commented May 11, 2023

Would it make sense to only include the browser?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Improve lost password email

7 participants