3 ms·

Only if you or the user refuse to use federated auth. And even then do you not have 2FA? Then your 2FA is reduced to 1FA by email? "There is no way around it"

by _8j50 4y ago

Only if you or the user refuse to use federated auth. And even then do you not have 2FA? Then your 2FA is reduced to 1FA by email? "There is no way around it" is such b.s., yes there is, pretend email does not exist, how would you do it? I think you skipped over parts of my post, there is a myriad of messaging applications if you insist control over some external account is the way to go. But really, the ideal way to do this would be have two sets of registration time challenges set. You can go with secret questions but also picture/emoji combinations, pins,patterns as the firsr piece and a second would either be a payment card for $0.01 charge or have them print one-time codes at registration time (second challenge skipped if second-factor auth is good). "I refuse to change" is what you are saying, you can think about this longer than a minute and come up with more and better ways than what I just mentioned. Not only is email based password reser unneccesary, it is dangerous and lazy.

remram 4y ago
Email can replace only the password, leaving you with 2FA still. Another messaging channel is fine of course. You could replace email address by a phone number for SMS/WhatsApp/Signal. Is that more secure though? Would a user rather give your random app their phone number than email address? Secret questions are usually very much not secret (less safe than password). They are way easier to uncover about a person, and still very much subject to re-use across sites. I am telling you that I haven't found anything as good and you reply that I must not have taken a single minute to think about it. I guess there's nothing more for us to discuss.
- _8j50 4y ago
  > Another messaging channel is fine of course. You could replace email address by a phone number for SMS/WhatsApp/Signal. Is that more secure though? Would a user rather give your random app their phone number than email address? Yes! Even insecure SMS is more secure than email. You know why? Because everybody and their mother is logging and inspecting email, I see people's reset codes and links all the time to everything from banks to porn sites! Many messaging systems including sms have no "account" to get phished either so while other attack vectors like malware infection remain (as with email), credential phishing as an attack vector is eliminated when using these messaging apps. Yes, many people in non-US countries use whatsapp,wechat,facebook or viber but don't even have an email until some retarded app forces them to get one just for the retarded registration system (in some, "internet access" even costs more with just FB,viber,whatsapp being the cheap default). Many gen-Z'ers also use messaging apps over email, it's like asking them to use aol or icq! And it is very convenient to block unwanted senders on those apps if you decide to sell their contact info or spam them with email (where with email it varies greatly with email client and provider). If you go by the numbers the majority of internet users are coerced into using email because people who design apps stuck in the 2000s. > Secret questions are usually very much not secret (less safe than password). They are way easier to uncover about a person, and still very much subject to re-use across sites. Depends a lot on how you implement them, again if you read my comment before replying I suggest pictures,emoji and patterns, you can ask them just about anything so long as it isn't information about them others can also learn easily. It is no different than passwords themselves being reused across sites, except here you control what easy to remember questions and answers to ask like "what are your too three emoji from this list" or "create a passphrase from a combination of these common words below", again, not a difficult problem unless in 2022 your assumption is there are many internet users incapable of remembering anything more than their mothers maiden name (who even knows that shit?) or whatever in which case there are plenty of other ways to provide challenges. > I am telling you that I haven't found anything as good and you reply that I must not have taken a single minute to think about it. I guess there's nothing more for us to discuss. You literally ignored the possibilities I listed, if you are disagreeing with my comment in ignorance of what I said then yes, let's not waste our time here.
  - remram 4y ago
    > such b.s > I think you skipped over parts of my post > "I refuse to change" is what you are saying > you can think about this longer than a minute > if you read my comment before replying Why are you so hostile? Why use an online forum at all if you will attack anyone engaging with you? You do have some good points there, but is this really the only way you are capable of expressing them?
    - _8j50 4y ago
      You seem to interpret attacks against your argument as attacks against your character, that's not the case. "Such b.s." refers to what you said, the rest of what you quoted is hostile but not to you as a person but a criticism of your thinking process and an expression of frustration when you take the time to replh but ignore the plain points I made in my comment and make generalized conclusions like how email is the only way without addressing any of the points in my comment that disagreed with what you are saying. I harbor no hostility towards you but I must criticize your argument and thinking process which might require directness and blutness which in a technical site like HN I would expect to be acceptable.
      - remram 4y ago
        I give up. If you don't see any ad-hominem in the parts I quoted for your convenience, then nothing I say will change your mind. If this is the least hostility you are capable of deploying against a person, thanks for trying I guess. Go forth into the world and yell in people's faces; some might benefit from it?

by _8j50 4y ago

remram 4y ago

Email can replace only the password, leaving you with 2FA still. Another messaging channel is fine of course. You could replace email address by a phone number for SMS/WhatsApp/Signal. Is that more secure though? Would a user rather give your random app their phone number than email address? Secret questions are usually very much not secret (less safe than password). They are way easier to uncover about a person, and still very much subject to re-use across sites. I am telling you that I haven't found anything as good and you reply that I must not have taken a single minute to think about it. I guess there's nothing more for us to discuss.

_8j50 4y ago
> Another messaging channel is fine of course. You could replace email address by a phone number for SMS/WhatsApp/Signal. Is that more secure though? Would a user rather give your random app their phone number than email address? Yes! Even insecure SMS is more secure than email. You know why? Because everybody and their mother is logging and inspecting email, I see people's reset codes and links all the time to everything from banks to porn sites! Many messaging systems including sms have no "account" to get phished either so while other attack vectors like malware infection remain (as with email), credential phishing as an attack vector is eliminated when using these messaging apps. Yes, many people in non-US countries use whatsapp,wechat,facebook or viber but don't even have an email until some retarded app forces them to get one just for the retarded registration system (in some, "internet access" even costs more with just FB,viber,whatsapp being the cheap default). Many gen-Z'ers also use messaging apps over email, it's like asking them to use aol or icq! And it is very convenient to block unwanted senders on those apps if you decide to sell their contact info or spam them with email (where with email it varies greatly with email client and provider). If you go by the numbers the majority of internet users are coerced into using email because people who design apps stuck in the 2000s. > Secret questions are usually very much not secret (less safe than password). They are way easier to uncover about a person, and still very much subject to re-use across sites. Depends a lot on how you implement them, again if you read my comment before replying I suggest pictures,emoji and patterns, you can ask them just about anything so long as it isn't information about them others can also learn easily. It is no different than passwords themselves being reused across sites, except here you control what easy to remember questions and answers to ask like "what are your too three emoji from this list" or "create a passphrase from a combination of these common words below", again, not a difficult problem unless in 2022 your assumption is there are many internet users incapable of remembering anything more than their mothers maiden name (who even knows that shit?) or whatever in which case there are plenty of other ways to provide challenges. > I am telling you that I haven't found anything as good and you reply that I must not have taken a single minute to think about it. I guess there's nothing more for us to discuss. You literally ignored the possibilities I listed, if you are disagreeing with my comment in ignorance of what I said then yes, let's not waste our time here.
- remram 4y ago
  > such b.s > I think you skipped over parts of my post > "I refuse to change" is what you are saying > you can think about this longer than a minute > if you read my comment before replying Why are you so hostile? Why use an online forum at all if you will attack anyone engaging with you? You do have some good points there, but is this really the only way you are capable of expressing them?
  - _8j50 4y ago
    You seem to interpret attacks against your argument as attacks against your character, that's not the case. "Such b.s." refers to what you said, the rest of what you quoted is hostile but not to you as a person but a criticism of your thinking process and an expression of frustration when you take the time to replh but ignore the plain points I made in my comment and make generalized conclusions like how email is the only way without addressing any of the points in my comment that disagreed with what you are saying. I harbor no hostility towards you but I must criticize your argument and thinking process which might require directness and blutness which in a technical site like HN I would expect to be acceptable.
    - remram 4y ago
      I give up. If you don't see any ad-hominem in the parts I quoted for your convenience, then nothing I say will change your mind. If this is the least hostility you are capable of deploying against a person, thanks for trying I guess. Go forth into the world and yell in people's faces; some might benefit from it?