4 ms·

The difference is that the password works as a shortcut for situations where the email approach adds lots of friction (working on a "guest" device, latency, the

by usrusr 6y ago

The difference is that the password works as a shortcut for situations where the email approach adds lots of friction (working on a "guest" device, latency, the entire world spam countermeasures). Friction is very much acceptable for password recovery (arguably even desirable), but not so much for conventional login. A nice middle ground would be allowing to opt out of passwords, for people who are happy with the combination of device token plus email OTP. This would work even better if device tokens were not binned with all those junk cookies: I think it could be valuable to have a class of "qualified cookies" that can only be written on user prompt and have reads optionally protected by additional local authentication requirements (configured on the user prompt), basically something that sits right in the middle between the streaming heap of cookies a browser stores and the browser's password store that allegedly nobody uses. I believe that this could be a major win for web privacy, "delete all cookies except for those which the store considered important enough to depend on a user prompt" (obviously, the client needs to include a "pretend to store, but actually keep only for the session" option to prevent abuse) You could almost implement this for a site already using the web storage API, except for the unclear client prompts and lack of fine-grained tying into additional client side authentication measures (e.g. like how you might want a password manager to maintain very different master key freshness requirements for different entries)

squiggleblaz 6y ago
> The difference is that the password works as a shortcut for situations where the email approach adds lots of friction (working on a "guest" device, latency, the entire world spam countermeasures). Friction is very much acceptable for password recovery (arguably even desirable), but not so much for conventional login. That's a general response to the question of why passwords might be nicer than email OTP. But it doesn't answer my question - namely, any security problems that might be attributed to email/SMS OTP also exist almost invariably with almost all in-the-wild password implementations, and therefore, isn't email OTP only more secure than password plus an email OTP called "password reset". This question is purely a rebuttal of the claim that passwords are more secure than email/SMS OTP. In the wild, there are a few sites where an email account, and therefore password reset, is optional. Hacker News and Reddit are examples. But these are in the extreme minority, and almost never secure anything worth securing. Bank accounts are another class of exceptions, where they secure something so valuable it is worthwhile going through a human verification process before you can do a password reset. But almost everything else - online stores, newspaper comment columns, much social media, web apps used for work, phone apps that let you monitor your robot vacuum cleaner, email accounts - almost all of them expect you to have an email address and use it for a password reset

by usrusr 6y ago

squiggleblaz 6y ago

> The difference is that the password works as a shortcut for situations where the email approach adds lots of friction (working on a "guest" device, latency, the entire world spam countermeasures). Friction is very much acceptable for password recovery (arguably even desirable), but not so much for conventional login. That's a general response to the question of why passwords might be nicer than email OTP. But it doesn't answer my question - namely, any security problems that might be attributed to email/SMS OTP also exist almost invariably with almost all in-the-wild password implementations, and therefore, isn't email OTP only more secure than password plus an email OTP called "password reset". This question is purely a rebuttal of the claim that passwords are more secure than email/SMS OTP. In the wild, there are a few sites where an email account, and therefore password reset, is optional. Hacker News and Reddit are examples. But these are in the extreme minority, and almost never secure anything worth securing. Bank accounts are another class of exceptions, where they secure something so valuable it is worthwhile going through a human verification process before you can do a password reset. But almost everything else - online stores, newspaper comment columns, much social media, web apps used for work, phone apps that let you monitor your robot vacuum cleaner, email accounts - almost all of them expect you to have an email address and use it for a password reset