4 ms·

Do you trust your email server? Do you trust your email client? Do you trust that you signed up with the right email address? If the answer to any of those i

Do you trust your email server? Do you trust your email client? Do you trust that you signed up with the right email address? If the answer to any of those is no, then it's not a good solution for you.

Pxtl 3y ago
More than I trust the traditional "try and remember a password or just reuse one and hope it never gets owned on any of a zillion servers"
toomuchtodo 3y ago
The answer to those questions are all yes if you allow password resets to that email address. If you don’t trust email, username and secure authenticator are your last resort. (Magic links are a good shim until passkeys are provided as a secure authenticator. Avoids needing to store a password, prevents credential stuffing. Not a substitute for MFA/2FA imho.)
- candiddevmike 3y ago
  As a user, when do you have control over whether to allow password resets via email?
  - toomuchtodo 3y ago
    You typically don’t. The service simply allows it at all times. If you don’t trust your email auth story, that is a challenging threat model for sure. Big fan of passkeys all around for this very reason (at the moment, they are unphishable), but the story around recovery in the event of a lost passkey needs improvement to close that gap (can’t just lose your account due to edge cases, need gov ID or something similar to elevate identity assurance back up for account recovery and rebind to digital identity). Google is upgrading everyone to passkeys [1], for example, which should help the Gmail email identity situation (which is material, as Gmail is one of the largest email providers [2]). Otherwise we end up with breaches like 23andme, where trivial credential spraying leads to data leakage [3]. This is entirely preventable, and the engineering time is not onerous to implement. Passwords must be left behind as quickly as possible. You have piqued my interest though; which service doesn't allow you to reset your password via your email on file (besides an account auth system like Mullvad)? [1] https://blog.google/technology/safety-security/passkeys-default-google-accounts/ https://blog.google/technology/safety-security/passkeys-defa... ("Google: Passwordless by default: Make the switch to passkeys") [2] https://www.demandsage.com/gmail-statistics/ https://www.demandsage.com/gmail-statistics/ ("Gmail has over 1.8 billion active users as of 2023, which means 22.22% of the world’s population uses Google’s mail service.") [3] https://news.ycombinator.com/item?id=37794379 https://news.ycombinator.com/item?id=37794379 ("HN: 23andMe says user data stolen in credential stuffing attack") Obligatory passkeys directories: https://passkeys.directory/ https://passkeys.directory/ | https://passkeys.2fa.directory/ https://passkeys.2fa.directory/ (responsible for customer and internal IAM at a fintech)

Pxtl 3y ago

More than I trust the traditional "try and remember a password or just reuse one and hope it never gets owned on any of a zillion servers"

toomuchtodo 3y ago

The answer to those questions are all yes if you allow password resets to that email address. If you don’t trust email, username and secure authenticator are your last resort. (Magic links are a good shim until passkeys are provided as a secure authenticator. Avoids needing to store a password, prevents credential stuffing. Not a substitute for MFA/2FA imho.)

candiddevmike 3y ago
As a user, when do you have control over whether to allow password resets via email?
- toomuchtodo 3y ago
  You typically don’t. The service simply allows it at all times. If you don’t trust your email auth story, that is a challenging threat model for sure. Big fan of passkeys all around for this very reason (at the moment, they are unphishable), but the story around recovery in the event of a lost passkey needs improvement to close that gap (can’t just lose your account due to edge cases, need gov ID or something similar to elevate identity assurance back up for account recovery and rebind to digital identity). Google is upgrading everyone to passkeys [1], for example, which should help the Gmail email identity situation (which is material, as Gmail is one of the largest email providers [2]). Otherwise we end up with breaches like 23andme, where trivial credential spraying leads to data leakage [3]. This is entirely preventable, and the engineering time is not onerous to implement. Passwords must be left behind as quickly as possible. You have piqued my interest though; which service doesn't allow you to reset your password via your email on file (besides an account auth system like Mullvad)? [1] https://blog.google/technology/safety-security/passkeys-default-google-accounts/ https://blog.google/technology/safety-security/passkeys-defa... ("Google: Passwordless by default: Make the switch to passkeys") [2] https://www.demandsage.com/gmail-statistics/ https://www.demandsage.com/gmail-statistics/ ("Gmail has over 1.8 billion active users as of 2023, which means 22.22% of the world’s population uses Google’s mail service.") [3] https://news.ycombinator.com/item?id=37794379 https://news.ycombinator.com/item?id=37794379 ("HN: 23andMe says user data stolen in credential stuffing attack") Obligatory passkeys directories: https://passkeys.directory/ https://passkeys.directory/ | https://passkeys.2fa.directory/ https://passkeys.2fa.directory/ (responsible for customer and internal IAM at a fintech)