3 ms·
I would like to see something where a postcard is mailed and a phone call, each with half of the code needed for a reset. Postcard should not be sent using a me
by extrapickles 11y ago
I would like to see something where a postcard is mailed and a phone call, each with half of the code needed for a reset. Postcard should not be sent using a method that supports forwarding so an attacker cannot setup a mail forward.
Customer support should not be able to see anything about these accounts except for a reset button. I do expect to be charge a fee for a reset if I need to use it. This would need to be rate limited to prevent people from dosing an account through it.
- PhantomGremlin 11y agoa postcard is mailed If you want them to go thru the trouble of mailing something, at least require it to be a letter. Inside an opaque envelope. A postcard is the exact opposite of something you want to use to send sensitive information.