3 ms·
Not every mail system supports that and the longer & harder to guess it is the more likely it is that whatever disaster lead to needing the recovery process wou
by acdha 3y ago
Not every mail system supports that and the longer & harder to guess it is the more likely it is that whatever disaster lead to needing the recovery process would also lose that information.
- layer8 3y agoThe rules on how long a local-part is allowed to be are very clear (https://datatracker.ietf.org/doc/html/rfc5321#section-4.5.3.1.1 https://datatracker.ietf.org/doc/html/rfc5321#section-4.5.3....), and once you’ve registered the address you would know that it works. You’d write it down and/or store it in your password manager like you would with any passphrase. I really don’t see the problem.
- acdha 3y agoIt’s not a question of whether it’s technically possible but practical to expect people to maintain a recovery address which is not otherwise used or guessable. If you can pull it off, sure, but from a security perspective I’d probably be looking for a way to avoid email at all for this mechanism since it just wasn’t designed around address privacy.