4 ms·
Wondering why I was downvoted for pointing this out. But anyways, my impression from reading the page was this is not just used as a password reset scenario bu
by newman314 15y ago
Wondering why I was downvoted for pointing this out.
But anyways, my impression from reading the page was this is not just used as a password reset scenario but as a general login method.
Which if you agree with, leads us back to the scenario where authentication & authorization lies solely with the email account, which if compromised is the single point of failure.
I would appreciate it if someone were to help point out what flaws there in this line of thought rather than a straight downvote with no explanation.
- Dove 15y agoIf an email account can be used for password reset, a compromised email account can be used to log in. Since much of the internet already works this way, the proposed system has a neutral effect on security, while making things easier for users. In effect, any site that offers a password reset via email is already using your email as your identity.
- bxc 15y agoI actually use this as the primary authentication mechanism for sites I rarely/occasionally visit... password reset at every login!