3 ms·
Tangential, but something I think about every time breaches or password managers come up is this: what if every time I log into a service, i do it through passw
by sixstringtheory 6y ago
Tangential, but something I think about every time breaches or password managers come up is this: what if every time I log into a service, i do it through password reset? that way I never have to even store the passwords, and it changes with the frequency of use. The more I use a given service, the less likely I am to be impacted by a password dataset being released. Basically the magic link that Slack uses, but with a few extra steps.
What would be some security pros and cons of this approach? And ultimately, [how] can e-mail be removed as the single point of failure?
- remram 6y agoA few services do that, for example Liberapay [1]. It's also not much different from how other social sign-in methods work (Facebook, Google, GitHub), only you already have your email on file. I guess the main drawback is the email delivery delay, which is much slower than an HTTP workflow. [1]: https://liberapay.com/sign-in https://liberapay.com/sign-in