3 ms·
Not really. Most of these services tie back to an account (most with an actual email address). Should a SSO provider ever stop working, you simply "reset thei
by SkyPuncher 5y ago
Not really. Most of these services tie back to an account (most with an actual email address).
Should a SSO provider ever stop working, you simply "reset their password". Send them a message to validate ownership of the account, then ask them to set a password OR authenticate with a different SSO provider.
----
These are the types of threats engineers _love_ wasting time analyzing.
- rectang 5y ago> Most of these services tie back to an account (most with an actual email address). Indeed, that design helps address the problem. But it also has implications for signup flow as you now need an email — which is why I'm advocating that engineers "consider" the issue. > These are the types of threats engineers _love_ wasting time analyzing. Sheesh, where's that hostility coming from?