What does a successful login record actually prove?¶
title: "What does a successful login record actually prove?" card_id: "IP-022" status: "complete" source_document: "https://docs.google.com/document/d/1XvCYDkwEt8RZ49rLsDSlwSf2xXVQ38rKHAbE6AL1UBk/edit?usp=drivesdk"
What does a successful login record actually prove?¶
What does a successful login record actually prove?¶
A successful login record normally shows that a service accepted the authentication presented for an account.
That might mean the correct password was entered.
It might mean a password and a second authentication factor were accepted.
Or it could involve a passkey, a saved session, a single sign-on service or another form of authentication.
The exact meaning depends on how that particular system records logins.
What it doesn’t automatically prove is that the named account holder personally entered the details.
Passwords can be shared, guessed, stolen or recovered from another device.
Someone may have access to a laptop or phone where the account is already signed in.
A browser may hold a valid session token, allowing somebody to access the account without entering the password again.
Even multi-factor authentication doesn’t identify the person with absolute certainty.
A notification might be approved accidentally. Someone might be persuaded to approve it. The second-factor device itself might be shared or under somebody else’s control.
Multi-factor authentication can strengthen the evidence that the account’s security process was completed. It doesn’t automatically prove who completed it.
The source IP address recorded with the login adds information about the network route seen by the service.
It may point to a home connection, workplace, mobile network, VPN, public Wi-Fi or another piece of infrastructure.
It still doesn’t identify the person sitting behind that connection.
The record may also include a user agent, device identifier, browser information or session identifier.
Those details can help link the login to other activity or to a particular device. But they need to be interpreted carefully.
User-agent information can be common to millions of devices. Device identifiers may be reset or changed. A device may also be used by several people.
A successful login record doesn’t necessarily prove what happened afterwards either.
It may show that authentication succeeded and that an authenticated session began. It doesn’t, by itself, prove that the account was used to send a message, download a file, change a setting or commit the activity being investigated.
Those actions should have their own supporting records where available.
So a successful login can be strong evidence that somebody gained authenticated access to an account at a particular time, using a particular network route and possibly a particular device or session.
It doesn’t, on its own, establish who that person was or what they did after gaining access.