2 ms·

How many sites do you use with "I forgot my password" features that send you email? Email is that exact single point of failure for most people.

• huhtenberg 19y ago
  No, it is not. The only place where the email can actually be a single point of anything is either my local Inbox or an Inbox at my mail provider. Latter is temporary, so compromising provider's systems does not jeopardize all my web accounts. And compromised local Inbox is an indication of a far more serious security breach, not isolated to the email. So, no, your analogy is wrong.
  • simonw 19y ago
    I don't see your point. If I steal the password for your e-mail somehow, I can access your inbox (through webmail or POP or whatever) and then use "I forgot my password" on sites you use to steal your accounts there. If you use webmail and don't delete your e-mail I can search through your inbox to figure out what those sites are. Seems like a pretty serious single point of failure to me.
    • huhtenberg 19y ago
      If Clickpass servers are compromised, then so will be all my web accounts. And I have no reason to believe they will not be. That's the point.
      • justindz 19y ago
        So, in a nutshell, you trust ClickPass security less than you trust your email provider's security. And, the margin is great enough to overcome whatever ease-of-use gains you might get from ClickPass over email. Did I get that right?
        • huhtenberg 19y ago
          Partially. There are attacks that specifically target me and there are attacks that are going after anyone with login credentials. The issue with ClickPass is that it wants to be choke full of latter guys. This makes it a fat and juicy target for someone looking to grab any credentials. The question of my trust in my email provider here is secondary. It is only relevant if I am personally the ultimate target. See the difference ? The bottom line is that they want to manage my confidential information. This is very ballsy of them and it comes with a LOT of responsibility whether they realize it or not. Or, perhaps, they want to deal with passwords that are OK to be compromised. In former case they (currently) lack credibility, in latter case they misrepresent what their service is about. Hence my original comment.