3 ms·
The idea is that you would use this in situations where you currently would offer a "reset password via email" option - since this means you already treats cont
by caf 15y ago
The idea is that you would use this in situations where you currently would offer a "reset password via email" option - since this means you already treats control of the email address as identity.
- newman314 15y agoWondering why I was downvoted for pointing this out. But anyways, my impression from reading the page was this is not just used as a password reset scenario but as a general login method. Which if you agree with, leads us back to the scenario where authentication & authorization lies solely with the email account, which if compromised is the single point of failure. I would appreciate it if someone were to help point out what flaws there in this line of thought rather than a straight downvote with no explanation.
- Dove 15y agoIf an email account can be used for password reset, a compromised email account can be used to log in. Since much of the internet already works this way, the proposed system has a neutral effect on security, while making things easier for users. In effect, any site that offers a password reset via email is already using your email as your identity.
- bxc 15y agoI actually use this as the primary authentication mechanism for sites I rarely/occasionally visit... password reset at every login!