3 ms·
I asked this exact question some years ago. I believe the answer has many parts: Effective security is tailored to the situation: the app, the users, and the
by mleonhard 6y ago
I asked this exact question some years ago. I believe the answer has many parts:
Effective security is tailored to the situation: the app, the users, and the adversaries.
Login emails are slow and require multiple steps. The user must enter their email into the website, switch to their email client, wait for the email, open it, and click the link. If the user's email goes down, they cannot log in to the website. Some folks get distracted while waiting for the email. Sometimes a login email will get marked as spam. Sometimes a user permanently loses access to their email account. These things reduce user engagement and increase support costs, and the company makes less money.
There are many ways for attackers to obtain email: DNS, BGP, email server, email server backups, user device backups, malware, re-used passwords, and phishing.
There are only a handful of ways for an attacker to obtain passwords: malware, password re-use, and phishing. Notice that this is a subset of the attacks on email. And passwords have special mitigations. Some devices have password managers that resist malware. Security teams have various options for reducing password re-use.
Good authentication depends on something you know (password) and something you have. Password managers turn something you know (password) into something you have (device). Criminals rarely steal devices to gain access to online accounts. So in practice, something you have is just as good as something you know.
- faeyanpiraat 6y agoI get the part where you list the possible inconveniences of email. What I dont get is how having smaller attack surface for losing a password, and using a secure password manager mitigates the attack vector of getting access to my account with a password reset through my compromised email. If I understand correctly you say that email is more vulnerable, so this only strenghtens my point I guess?
- mleonhard 6y agoPassword reset is a rare event, so it has extra mitigations: 1. Extra security checks. For example, if you buy a new laptop and use a coffee shop's wifi try to reset your bank password, they will lock your account. You will have to call and talk to a person and give extra personal information to get it unlocked. 2. Notify the user about the password reset. Use email, text, phone call, and postal mail. 3. Automatically lock the account if suspicious activity occurs in a time period after password reset. Examples: - Orders over $100 shipped to new addresses. - Risky transactions: buying gift cards, buying plane tickets in foreign countries, changing the delivery address of a shipment. - Using a known device (with cookies/fingerprint) and the old password. 4. Require extra confirmation for transactions. Examples: re-enter credit card numbers, security codes, and personal id numbers (SSN in USA). 5. Preserve user data so it can be restored to the state before the password reset. These mitigations work well enough for protecting accounts from fraudulent password resets.
- faeyanpiraat 6y agoThanks, this was the missing puzzle piece.