4 ms·
> Once your email is hacked, you will be globally owned. This is also true for 99% of online services that have a "forgot password" function that uses your ema
by matharmin 9y ago
> Once your email is hacked, you will be globally owned.
This is also true for 99% of online services that have a "forgot password" function that uses your email address. If your site is in the 1% that needs stronger security, then don't use this.
> You’ll also need to logon to your email to access whatever site which means whatever keylogger is installed on whatever computer you use in some public place will also be a threat.
Valid point, but it's an edge case that's not applicable to most people. The most common use for using a public computer is probably checking email. Even that happens less these days, which people just using their phones + public WiFi instead.
- hoffs 9y agoThat's the point that I see as well. It's like if they get your email they will be able to get your user/password account anyways. So this seems like a decent way of getting rid of the password.
- rasengan 9y agoWhen user password are used for security, proper services have additional questions (in other words 2FA) to reset your password by email.
- WorldMaker 9y agoAdditional questions are bonus passwords. They are not 2FA.
- rasengan 9y agoAlso want to add incase anyone is reading that you don't want to set your systems security based on some lowest denominator that you can't even secure / control. Seems unreasonable and insecure.
- rasengan 9y agoPublic computer is for probably checking email. You said it yourself. Hence a proper adversary has already pwned these devices.