3 ms·
They're just recovery codes by a different name and with a built-in hint. I could reset the password of half of my friends from what I know. For a random person
by renewiltord 3y ago
They're just recovery codes by a different name and with a built-in hint. I could reset the password of half of my friends from what I know. For a random person, I could probably just use something like this https://www.fastbackgroundcheck.com/people/gavin-newsom/san-francisco-ca https://www.fastbackgroundcheck.com/people/gavin-newsom/san-... and get almost all the way there.
As a user, if you want guessable recovery codes, that's fine. It's all in the threat model. The password for this account is very guessable. It used to be 000000. I don't care about any possible threat to it.
- eli 3y agoI don't think most users care much one way or the other. But they do sometimes lose their credentials and need a password reset and if the reset flow assumes you'll be able to answer those questions anyway, you're going to have a bad time.
- ghaff 3y agoIn general, you don't want a forgotten password to be a "sucks to be you" situation or even a come to a physical office with two forms of ID situation.