5 ms·

As a user, when do you have control over whether to allow password resets via email?

toomuchtodo 3y ago
You typically don’t. The service simply allows it at all times. If you don’t trust your email auth story, that is a challenging threat model for sure. Big fan of passkeys all around for this very reason (at the moment, they are unphishable), but the story around recovery in the event of a lost passkey needs improvement to close that gap (can’t just lose your account due to edge cases, need gov ID or something similar to elevate identity assurance back up for account recovery and rebind to digital identity). Google is upgrading everyone to passkeys [1], for example, which should help the Gmail email identity situation (which is material, as Gmail is one of the largest email providers [2]). Otherwise we end up with breaches like 23andme, where trivial credential spraying leads to data leakage [3]. This is entirely preventable, and the engineering time is not onerous to implement. Passwords must be left behind as quickly as possible. You have piqued my interest though; which service doesn't allow you to reset your password via your email on file (besides an account auth system like Mullvad)? [1] https://blog.google/technology/safety-security/passkeys-default-google-accounts/ https://blog.google/technology/safety-security/passkeys-defa... ("Google: Passwordless by default: Make the switch to passkeys") [2] https://www.demandsage.com/gmail-statistics/ https://www.demandsage.com/gmail-statistics/ ("Gmail has over 1.8 billion active users as of 2023, which means 22.22% of the world’s population uses Google’s mail service.") [3] https://news.ycombinator.com/item?id=37794379 https://news.ycombinator.com/item?id=37794379 ("HN: 23andMe says user data stolen in credential stuffing attack") Obligatory passkeys directories: https://passkeys.directory/ https://passkeys.directory/ | https://passkeys.2fa.directory/ https://passkeys.2fa.directory/ (responsible for customer and internal IAM at a fintech)

You typically don’t. The service simply allows it at all times. If you don’t trust your email auth story, that is a challenging threat model for sure. Big fan of passkeys all around for this very reason (at the moment, they are unphishable), but the story around recovery in the event of a lost passkey needs improvement to close that gap (can’t just lose your account due to edge cases, need gov ID or something similar to elevate identity assurance back up for account recovery and rebind to digital identity). Google is upgrading everyone to passkeys [1], for example, which should help the Gmail email identity situation (which is material, as Gmail is one of the largest email providers [2]). Otherwise we end up with breaches like 23andme, where trivial credential spraying leads to data leakage [3]. This is entirely preventable, and the engineering time is not onerous to implement. Passwords must be left behind as quickly as possible. You have piqued my interest though; which service doesn't allow you to reset your password via your email on file (besides an account auth system like Mullvad)? [1] https://blog.google/technology/safety-security/passkeys-default-google-accounts/ https://blog.google/technology/safety-security/passkeys-defa... ("Google: Passwordless by default: Make the switch to passkeys") [2] https://www.demandsage.com/gmail-statistics/ https://www.demandsage.com/gmail-statistics/ ("Gmail has over 1.8 billion active users as of 2023, which means 22.22% of the world’s population uses Google’s mail service.") [3] https://news.ycombinator.com/item?id=37794379 https://news.ycombinator.com/item?id=37794379 ("HN: 23andMe says user data stolen in credential stuffing attack") Obligatory passkeys directories: https://passkeys.directory/ https://passkeys.directory/ | https://passkeys.2fa.directory/ https://passkeys.2fa.directory/ (responsible for customer and internal IAM at a fintech)