5 ms·
If someone has access to your email client you're hooped anyway. There is nothing stopping an extra security conscious user from deleting the email and changin
by redstripe 15y ago
If someone has access to your email client you're hooped anyway.
There is nothing stopping an extra security conscious user from deleting the email and changing their password right away. What it does is to give a convenience to users that want to treat your service as a trial. Picking unique user names and password is too far down the developing a relationship path for me personally.
- lukifer 15y agoAgainst knowledgeable techies, sure, you're hosed either way. I'm talking about more casual security threats: a mischievous child, a bad breakup, a sneaky Best Buy bench tech. It's the difference between leaving your front door unlocked, versus leaving it wide open.
- jules 15y agoDon't most sites offer password recovery via email?
- sorbits 15y ago> If someone has access to your email client you're hooped anyway. I once made the mistake of emailing a friend of mine the password to an ssh account — roughly 6 months later someone logged in with that password and added a spammy link to one of my HTML pages — my friends machine wasn’t hacked, but likely the (university) server storing his email had. Also, our online shop email the buyers from a generated non-guessable address (to track replies/bounces). Occasionally these receive spam. So I don’t trust that what I write in an email is only seen by the person it is sent to, unless the content is encrypted. And just for the records, I disabled password login and installed fail2ban long ago to avoid new server break-ins :)