7.6 Login Alerts, Session Risks, and Recovery Mistakes
Login Alerts Are Free Telemetry — If You Keep Them
“New sign-in from Lagos on Chrome/Windows” notifications are the cheapest detection control in consumer security, and adversaries know it: a top post-compromise action is to disable notifications, delete recovery contacts, and rotate the recovery email before the victim ever sees an alert. Treat every sign-in notice as an audit event. Verify it from a second device (never through a link inside the notice itself, since the same channel may be monitored), and when something looks foreign, sign out everywhere and re-authenticate before touching anything else.
Impossible Travel and the Stolen-Cookie Problem
Risk engines score each login on distance over time: an account used in Berlin and San Francisco ninety minutes apart exceeds any legal flight speed, so the event is stepped up or held. But modern infostealer malware — the RedLine/StealVex-style commodity loaders — lifts session cookies directly from the victim’s browser database, and the attacker’s replayed request arrives with the real device fingerprint and a residential IP. It sails past geo checks because no password was entered at all. Defenses therefore move to the token itself: HttpOnly, Secure, SameSite cookie flags, short session TTLs with re-auth for sensitive actions, and cryptographic token binding (DPoP or mTLS) that ties a token to a client key so a copied cookie is inert on another machine.
Recovery Paths Undo Everything Else
Check the loop: the email address identifies the account, receives the login alerts, and owns the password-reset link. Anyone who reads that mailbox can therefore reset into the account, disable the alerts, and close the loop behind them — email is simultaneously the alarm system and the burglar master key. Break the cycle: make a hardware security key the recovery credential, store one-time recovery codes offline (printed, not in the mailbox), require a waiting period with advance notification on credential changes, and never let a phone-number reset stand as the sole path for high-value accounts.
Session Hygiene Checklist
Revoke all sessions on password change, credential entry, or any alert you did not generate; expire idle sessions; require re-verification before payment or export actions; and on shared or borrowed machines sign out explicitly rather than just closing the tab. Detection only pays out when it triggers a response, so pair every alert with one rehearsed action.
Architecture Diagram
Key Takeaways
- Act on every sign-in alert from a second device; attackers disable alerts as their first post-compromise action.
- Impossible-travel rules catch typed-in password logins, not replayed stolen session cookies.
- Cookie flags, short TTLs, and token binding (DPoP/mTLS) neutralize lifted sessions that geo checks cannot see.
- If the mailbox is both identifier and recovery channel, one loop hands an email reader total account control.
- Break the loop with hardware-key recovery, offline recovery codes, and notified waiting periods on changes.