3 ms·
I consider this huge. Aside from the obvious man-in-the-middle network attacks that could capture this easily, it also creates a huge physical security flaw: if
by lukifer 16y ago
I consider this huge. Aside from the obvious man-in-the-middle network attacks that could capture this easily, it also creates a huge physical security flaw: if you save/archive your emails, I can sit down at your machine, type "password" in the search box of your mail client, and trivially steal a dozen or so of your passwords. If these weren't auto-generated, it's even worse, as most people re-use passwords.
- redstripe 16y agoIf someone has access to your email client you're hooped anyway. There is nothing stopping an extra security conscious user from deleting the email and changing their password right away. What it does is to give a convenience to users that want to treat your service as a trial. Picking unique user names and password is too far down the developing a relationship path for me personally.
- lukifer 16y agoAgainst knowledgeable techies, sure, you're hosed either way. I'm talking about more casual security threats: a mischievous child, a bad breakup, a sneaky Best Buy bench tech. It's the difference between leaving your front door unlocked, versus leaving it wide open.
- jules 16y agoDon't most sites offer password recovery via email?
- sorbits 16y ago> If someone has access to your email client you're hooped anyway. I once made the mistake of emailing a friend of mine the password to an ssh account — roughly 6 months later someone logged in with that password and added a spammy link to one of my HTML pages — my friends machine wasn’t hacked, but likely the (university) server storing his email had. Also, our online shop email the buyers from a generated non-guessable address (to track replies/bounces). Occasionally these receive spam. So I don’t trust that what I write in an email is only seen by the person it is sent to, unless the content is encrypted. And just for the records, I disabled password login and installed fail2ban long ago to avoid new server break-ins :)
- blake8086 16y agoConsidering the "forgot password" fallback for virtually every site is your email address, and you can't disable it, most websites are only as secure as your email security.