3 ms·

“Not have any security issues whatsoever” is literally impossible. Passwordless auth is the security equivalent of putting all your eggs in one basket. If someo

“Not have any security issues whatsoever” is literally impossible. Passwordless auth is the security equivalent of putting all your eggs in one basket. If someone hacks a users email account, now they have access to your service too. Now I’m pissed that you didn’t let me enable 2fa to prevent that or have multiple secure passwords to isolate the hack to my email. You could have just shelled out the 10 cents it would have cost to have my account in auth0 and prevent all of this with 2fa and fraud detection.

yannoninator 6y ago
just use a fake email? you don't have to use your real email for everything, even google has forwarding addresses. and apple has private/forwarding emails as well, so this is a moot point.
- chickenpotpie 6y ago
  Forwarding email increases risk of being hacked. They only have to get one of the emails to get into my account.
  - yannoninator 6y ago
    So you hack apple's private forwarding email service right, how would one get in? I've even used G Mail's forwarding email for 6 years and I've never been hacked. If you're concerned about this just use a fake email.
    - chickenpotpie 6y ago
      You’ve gone off on a personal tangent about how I as a user can increase my security. The topic of discussion was you claimed passwordless security had no security issues and I pointed out possible security issues. An individual can mitigate them, but they still exist
      - yannoninator 6y ago
        > The topic of discussion was you claimed passwordless security had no security issues and I pointed out possible security issues. But you claimed that the email can be hacked, I used an email forwarding service provided by google or apple. So are you saying I can be hacked through this way, please provide evidence of this happening in a real world passwordless scenario. > An individual can mitigate them, but they still exist Again, I would be more convinced of real world evidence and statistics rather than theorising.
        chickenpotpie 6y ago
        > But you claimed that the email can be hacked, I used an email forwarding service provided by google or apple. I'm not arguing than an intelligent user can't get rid of security issues. I'm saying a product that uses passwordless login still has security issues. Not every user is going to do that and theyre gonna blame you when they get hacked. > Again, I would be more convinced of real world evidence and statistics rather than theorising. You first. You made the initial claim that passwordless login has no security issues. Systems should be assumed insecure unless proven otherwise.
        yannoninator 6y ago
        > I'm not arguing than an intelligent user can't get rid of security issues. I'm saying a product that uses passwordless login still has security issues. Like what? you keep saying "still has security issues", but you don't give any real world examples. Just saying "still has security issues" is not a good argument. > You first. Lots of companies use this method in the real world, Slack, Medium, Freetrade, Substack, Monzo (a bank) and many more. If a bank and a stock trading app is comfortable using this method, I am sure they are comfortable with the security of this method. In addition, I already have given examples in this thread which you willingly choose to ignore. Your turn, start with this: > Forwarding email increases risk of being hacked. They only have to get one of the emails to get into my account. Proof?

yannoninator 6y ago

just use a fake email? you don't have to use your real email for everything, even google has forwarding addresses. and apple has private/forwarding emails as well, so this is a moot point.

chickenpotpie 6y ago
Forwarding email increases risk of being hacked. They only have to get one of the emails to get into my account.
- yannoninator 6y ago
  So you hack apple's private forwarding email service right, how would one get in? I've even used G Mail's forwarding email for 6 years and I've never been hacked. If you're concerned about this just use a fake email.
  - chickenpotpie 6y ago
    You’ve gone off on a personal tangent about how I as a user can increase my security. The topic of discussion was you claimed passwordless security had no security issues and I pointed out possible security issues. An individual can mitigate them, but they still exist
    - yannoninator 6y ago
      > The topic of discussion was you claimed passwordless security had no security issues and I pointed out possible security issues. But you claimed that the email can be hacked, I used an email forwarding service provided by google or apple. So are you saying I can be hacked through this way, please provide evidence of this happening in a real world passwordless scenario. > An individual can mitigate them, but they still exist Again, I would be more convinced of real world evidence and statistics rather than theorising.
      - chickenpotpie 6y ago
        > But you claimed that the email can be hacked, I used an email forwarding service provided by google or apple. I'm not arguing than an intelligent user can't get rid of security issues. I'm saying a product that uses passwordless login still has security issues. Not every user is going to do that and theyre gonna blame you when they get hacked. > Again, I would be more convinced of real world evidence and statistics rather than theorising. You first. You made the initial claim that passwordless login has no security issues. Systems should be assumed insecure unless proven otherwise.
        yannoninator 6y ago
        > I'm not arguing than an intelligent user can't get rid of security issues. I'm saying a product that uses passwordless login still has security issues. Like what? you keep saying "still has security issues", but you don't give any real world examples. Just saying "still has security issues" is not a good argument. > You first. Lots of companies use this method in the real world, Slack, Medium, Freetrade, Substack, Monzo (a bank) and many more. If a bank and a stock trading app is comfortable using this method, I am sure they are comfortable with the security of this method. In addition, I already have given examples in this thread which you willingly choose to ignore. Your turn, start with this: > Forwarding email increases risk of being hacked. They only have to get one of the emails to get into my account. Proof?