3 ms·
> If your email is compromised, the attacker can request a password reset, then log in that way. Doesn't this answer your own question? (ideally email password
by GordonS 6y ago
> If your email is compromised, the attacker can request a password reset, then log in that way.
Doesn't this answer your own question? (ideally email password reset should also require MFA)
As another, non-security point, occasionally it can take a good few minutes for emails to arrive in your inbox. Though to be fair, that's sometimes the case for SMS too.
- faeyanpiraat 6y agoI dont see how it would answer my question. If you can log in with a password, you have 1 way to get hacked (lose the pw). If you can also log in through a pass reset, then you have 2 ways to get hacked. MFA helps, but if I remember correctly Troy shared disappointing statistics about it’s usage by the general public.