3 ms·
Agreed with OP, the security is basically nonexistent anyway due to Forgot Password flow making email the authority regardless. Sure, add a user/pass flow in
by dogcomplex 2y ago
Agreed with OP, the security is basically nonexistent anyway due to Forgot Password flow making email the authority regardless. Sure, add a user/pass flow in addition for convenience and added security (i.e. delay the 3 minutes it takes to do a reset), but any real security would have to remove Forgot Password altogether or seriously delay turnaround time.