3 ms·
So, if my password is compromised (or I just routinely change it after some self-defined "expiry date"), I have to visit all my devices and reauthenticate them?
by drdaeman 16y ago
So, if my password is compromised (or I just routinely change it after some self-defined "expiry date"), I have to visit all my devices and reauthenticate them?
I believe this is counter-intuitive and inconvenient. If some of my devices (tokens) are compromised, I'd just go to Dropbox web interface and revoke their tokens.
- tptacek 16y agoNormal people assume that if their account is compromised, the appropriate countermeasure is to change their password and get on with your life. Is Dropbox a tool for normal people or for people who geek out on device authentication?
- drdaeman 16y agoSo, in proposed scheme, they change the password and everything goes out of sync. The proper and perfectly intuitive way is to not think what users'll assume. Just add a checkbox "also, unlink all my devices" on the very password change page.