28 ms·
The second component of this, for people that doesn’t care to do good track of their passwords, is that their email passwords are usually memorable in the wrong
by gmuslera 2y ago
The second component of this, for people that doesn’t care to do good track of their passwords, is that their email passwords are usually memorable in the wrong way. So both your mail and all the dependent services are all held together with the same weak clip.
Double factor improved a bit this, or at least made it harder to break into this to some of the players, and simplified the process for some others.
- Ekaros 2y agoEmail passwords is interesting one. As my feeling with something like gmail is that you insert it approximately once or twice per device... Which leads to weird dynamic that you have to recall it way too rarely for actually to remember it properly...
- lelanthran 2y ago> The second component of this, for people that doesn’t care to do good track of their passwords, is that their email passwords are usually memorable in the wrong way. So both your mail and all the dependent services are all held together with the same weak clip. The point is that they are already tied together because most sites allow password reset (or account recovery) via email. It doesn't matter how securely your sign-on is designed, what identification token you are using (username, biometrics), what authentication mechanism is in place (passwords, MFA, yubikey, etc) if all an attacker has to do is type in the targets email and click 'forgot password'. If your site allows password resets or account recovery via email, then the users account is still only as secure as their email password anyway. Adding yubikeys, MFA, authenticator apps, etc into the mix doesn't move the security needle a single bit at all.