# Security breach in Discourse forum with SSO
**URL:** https://meta.discourse.org/t/security-breach-in-discourse-forum-with-sso/55759
**Category:** SSO
**Created:** [14 januari 2017 om 12:01 UTC](https://meta.discourse.org/t/security-breach-in-discourse-forum-with-sso/55759 "2017-01-14T12:01:32Z")
**Posts on this page:** 2
**Page:** 2
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [20 januari 2017 om 21:28 UTC](https://meta.discourse.org/t/security-breach-in-discourse-forum-with-sso/55759/26 "2017-01-20T21:28:30Z")
We will also likely be adding email confirmation to backup downloads in 1.8 to verify the person downloading the backup controls the target account email as well, not just the password. This is a form of two-factor auth.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [1 maart 2017 om 23:41 UTC](https://meta.discourse.org/t/security-breach-in-discourse-forum-with-sso/55759/27 "2017-03-01T23:41:39Z")
Email confirmation of backup downloads is now in, thanks to @blake. You can’t download backups simply by being logged in, you must..
1. Be logged in as an admin → to get to `/admin/backups`
2. Control the email address of an admin → to receive the download link email
So this is indeed a form of two factor auth. Verifies control of the email account, _plus_ the ability to log in as the admin. Here’s the actual email the admin will receive when the download backup button is pressed; it warns about unknown attempts to download the site database:
> Here’s the [site backup download](http://example.com) you requested.
>
> We sent this download link to your validated email address for security reasons.
>
> (If you _didn’t_ request this download, you should be seriously concerned – someone has admin access to your site.)
Along with the major cookie token security database changes in 1.8, this should make it _much_ harder to have a full DB breach out there, and once it is out there, the damage is considerably less.
[Vorige pagina](https://meta.discourse.org/t/security-breach-in-discourse-forum-with-sso/55759.md?page=1)