3 ms·
I've seen several sites that don't have permanent password at all. You just tell them your email/phone no, and they send you the temporary password, which expir
by smsm42 6y ago
I've seen several sites that don't have permanent password at all. You just tell them your email/phone no, and they send you the temporary password, which expires after the short time. Looks a bit unusual, but the security is not much different from any site that has password recovery by email/SMS - if somebody gets control over your email, you're toast, otherwise you're ok. I wonder why more sites don't do this...
- teitoklien 6y agoI guess to reduce friction for signing in Most apps are not significant enough that people will go through the pain of checking their emails to get the new temporary password Also , a lot of email clients still use STARTTLS while communicating with mail servers to fetch emails , which means a MiTM can reduce that connection to plain text (isp’s have been caught doing this before to read people’s emails) and then steal your password. A site that enforces a rule like that must guarantee that its user’s email server only allows TLS only handshakes on client side (which is difficult if not impossible to do 100% of the time) So even if the idea is great , due to the state email is in , it’s pretty risky and unsafe to MiTM attacks and network inspection.