3 ms·
Thought that popped into my head. Instead of having separate passwords for different sites, now you are trusting your email provider to be absolutely secure (wi
by newman314 15y ago
Thought that popped into my head. Instead of having separate passwords for different sites, now you are trusting your email provider to be absolutely secure (with that one ultra-secure password you are using, right?).
So if a BrowserID user were to ever get their email service compromised, it's keys to the kingdom.
IMO, I think this needs a rethink.
- caf 15y agoThe idea is that you would use this in situations where you currently would offer a "reset password via email" option - since this means you already treats control of the email address as identity.
- newman314 15y agoWondering why I was downvoted for pointing this out. But anyways, my impression from reading the page was this is not just used as a password reset scenario but as a general login method. Which if you agree with, leads us back to the scenario where authentication & authorization lies solely with the email account, which if compromised is the single point of failure. I would appreciate it if someone were to help point out what flaws there in this line of thought rather than a straight downvote with no explanation.
- Dove 15y agoIf an email account can be used for password reset, a compromised email account can be used to log in. Since much of the internet already works this way, the proposed system has a neutral effect on security, while making things easier for users. In effect, any site that offers a password reset via email is already using your email as your identity.
- bxc 15y agoI actually use this as the primary authentication mechanism for sites I rarely/occasionally visit... password reset at every login!
- pornel 15y ago> you are trusting your email provider to be absolutely secure Yes, because e-mailed password reminders are keys to my kingdom already.