4 ms·
I was thinking the same thing. Any MITM can intercept the reset-password link email and set the password to whatever they want then login with the email.
by karmakaze 2y ago
I was thinking the same thing. Any MITM can intercept the reset-password link email and set the password to whatever they want then login with the email.
- tyzoid 2y agoThe difference is usually time - your actual password sitting in plaintext in your inbox vs a code that's only valid for 10min-24h. In my opinion, it's marginally more likely for a full point-in-time comprimise of an email account. A credential that has already expired is less useful than one still valid. Granted, if an attacker can trigger a password reset and also have persistant access to an inbox, there's still an issue there, but it's at least less bad.
- karmakaze 2y agoYes, the only real difference is passive harvesting of email/passwords. Anything targeted is similarly insecure.