3 ms·

> Anyone with access to your email account can simply reset any password on any site. The right solution is to make your email account very, very secure. No, t

by romaniv 11y ago

> Anyone with access to your email account can simply reset any password on any site. The right solution is to make your email account very, very secure. No, the right solution is to stop using email as sole identification for password resets. Yes, there are other solutions you can implement right now without waiting for some big company to save you. The most obvious one it to create a second factor of authentication just for account resets. It could be via an SMS OR simply by asking user to print out/write down a special randomly generated "reset" number. "But SMS costs money!" No, for most providers you can send an email to a special address reserved for the phone number. It will get translated to SMS automatically. "But users will forget/loose their reset number!" Maybe, maybe not. It's a cultural thing. You don't expect them to loose access to their email, but that happens all the time.

devit 11y ago
You can use a dedicated e-mail address for accounts.
ygjb 11y ago
SMS is an awful point of failure to inject into a protocol. It is plain-text, monitored in many countries, and can be unreliable and expensive in emerging markets, and just no. "But users will forget/loose their reset number!" Maybe, maybe not. It's a cultural thing. Really? Can you cite anything here that indicates this is the case? Users treat email access differently, seeing as how it's bound to user identity, usually across dozens, if not hundreds of services.
- tim333 11y ago
  SMS though provides a higher level of security. Some hacker anywhere on the planet could have accessed my email and passwords but they can't get a code sent to my phone unless they are nearby and have got hold of the phone. I'm not sure it being plain text and monitored matters much as all that's bring sent is a random number usually. I'll admit it could cost more and so may not be the thing for sites with lots of free users. If you can't get sms some sites will phone you with a recorded message.
icebraining 11y ago
"But SMS costs money!" No, for most providers you can send an email to a special address reserved for the phone number. It will get translated to SMS automatically. That's mostly an US-only solution. In most countries, there's no free email2sms gateway, since our incoming SMSs are free. Also, I don't want to share my phone number with you, random Internet site owner. Email spam is worse enough as it is. "But users will forget/loose their reset number!" Maybe, maybe not. It's a cultural thing. You don't expect them to loose access to their email, but that happens all the time. They won't lose or forget it; they just won't save it in the first place, except maybe for a couple of very important sites. If people don't use password managers, what makes you think they'll manage some database (physical or not) of reset codes for each site they register for?

by romaniv 11y ago

devit 11y ago

You can use a dedicated e-mail address for accounts.

ygjb 11y ago

SMS is an awful point of failure to inject into a protocol. It is plain-text, monitored in many countries, and can be unreliable and expensive in emerging markets, and just no. "But users will forget/loose their reset number!" Maybe, maybe not. It's a cultural thing. Really? Can you cite anything here that indicates this is the case? Users treat email access differently, seeing as how it's bound to user identity, usually across dozens, if not hundreds of services.

tim333 11y ago
SMS though provides a higher level of security. Some hacker anywhere on the planet could have accessed my email and passwords but they can't get a code sent to my phone unless they are nearby and have got hold of the phone. I'm not sure it being plain text and monitored matters much as all that's bring sent is a random number usually. I'll admit it could cost more and so may not be the thing for sites with lots of free users. If you can't get sms some sites will phone you with a recorded message.

icebraining 11y ago

"But SMS costs money!" No, for most providers you can send an email to a special address reserved for the phone number. It will get translated to SMS automatically. That's mostly an US-only solution. In most countries, there's no free email2sms gateway, since our incoming SMSs are free. Also, I don't want to share my phone number with you, random Internet site owner. Email spam is worse enough as it is. "But users will forget/loose their reset number!" Maybe, maybe not. It's a cultural thing. You don't expect them to loose access to their email, but that happens all the time. They won't lose or forget it; they just won't save it in the first place, except maybe for a couple of very important sites. If people don't use password managers, what makes you think they'll manage some database (physical or not) of reset codes for each site they register for?