3 ms·
Why? You could have a 100% secure website, but if the user gives their credentials to someone else (another website in this case), and that website with bad sec
by gkbrk 3y ago
Why? You could have a 100% secure website, but if the user gives their credentials to someone else (another website in this case), and that website with bad security gets hacked and leaks the credentials, how is that their fault?
- Spivak 3y agoBecause we've known about credential reuse for 20+ years, developed multiple means to keep a site secure when it happens and then chose to not employ those security measures on data people broadly consider incredibly sensitive. It is your job as a service provider to not allow access to anyone but the authorized user, how you do it is an implementation detail. You can't throw up your hands and say "well we decided that doing that is too hard so we're defining the authorized user as anyone who knows the password."