3 ms·
If the email is compromised, the hacker can just go to the front page in their own browser and generate a fresh login email, so there's no extra protection in c
by joosters 4y ago
If the email is compromised, the hacker can just go to the front page in their own browser and generate a fresh login email, so there's no extra protection in client-side browser secrets.
- xxs 4y agoIt'd be ok, if there is (yet) another factor for doing this, e.g. SMS, time based tokens, and you'd need 2 of them to reset the 3rd. Cumbersome to put it mildly.