How secure should an account activation be?

Question

I'm writing an account activation process from the ground up in Django, and here was my basic thought process:

Create a model like:

class UserAccountActivation(models.Model):
    lock = models.CharField(max_length=16)
    key = models.CharField(max_length=16)

Generate lock and key values when necessary using a function like this:

def generate_entry():
    """Generate a random alphanumeric string between 8 and 16 characters long."""
    ''.join(random.choice(string.ascii_lowercase + string.digits) for x in range(random.randint(8,16))

Compose a link like this:

r'^activate/(?P<lock>\w{8,16})/(?P<key>\w{8,16})/?$'

And send it out. When they hit the link, I activate the account and disable the activation key.

I was originally thinking of hashing the random strings as an extra precaution, but this seems unnecessary and it'd be pretty long to have two 32-length keys in my URL:

account/12345678/12345678
    or
account/12345678901234567890123456789012/12345678901234567890123456789012

Is this a safe and recommended way of handling account activation? Is it necessary to even have the random length on the strings?

Answer 1

Well, to answer that question you have to consider why you have protection on your account activation. Likely it is to prevent people from guessing the activation code, so they would be able to use a false email address. As email addresses are very easy to get anyway, the activation process doesn't need to be much harder than it would take to register an email account somewhere on the web. Anything more is wasted effort, as the attacker will simply shift the attack to another weak point.

Using random strings is perfectly fine for this.

If you need more security you can consider putting a hashed account id in there, so you can count and then stop multiple failed attempts to guess the activation code.

Answer 2

It is a good thing to have variable length, lest it is susceptible to timing attacks.

Also, python's inbuilt random is not really cryptographicaly safe, so it is always preferable to use sha from hashlib or the system random generated via linux which you can obtain by making a sys call.