5 ms·
No. If a SaaS service can automatically set/reset my password without any intervention on my part, that means I have passwords, in unencrypted form, sitting on
by JonathonW 7y ago
No. If a SaaS service can automatically set/reset my password without any intervention on my part, that means I have passwords, in unencrypted form, sitting on a third-party server I don't control. What happens when (and it is when, not if) "nopassword" is breached?
- sytse 7y agoSome services are more secure than others, 1password and Okta never saw a large breach as far as I know. If a breach would occur the race would be on to reset the password before the hackers would change the email address. You can imagine having 1% of canary accounts that give a big alert if their email is every changed leading to a race to see who can reset accounts first.
- macNchz 7y agoThey key difference around the risk of security breaches between this proposed service and 1password is that user data in the 1password cloud is encrypted client-side with a key derived from the user's master password, so there is no way for anyone who gains server access to see the passwords. In the proposed nopassword service, the server would have to maintain passwords in a less secure way, since it would need access to them in plain text to automate setting/resetting/filling them.
- sytse 7y agoI agree it is less secure in that way.