3 ms·
just stick with passwords then
by _1tem 1y ago
just stick with passwords then
- danenania 1y agoIf you have password reset via email, as almost every service using passwords does, there’s no security gain over magic links/codes. It’s actually worse, since now the email account or the password get you in, vs. just the email account.
- MetaWhirledPeas 1y ago> If you have password reset via email, as almost every service using passwords does, there’s no security gain over magic links/codes. I disagree. The problem with the magic code is that you've trained the user to automatically enter the code without much scrutiny. If one day you're attempting to access malicious.com and you get a google.com code in your email, well you've been trained to take the code and plug it in and if you're not a smarty then you're likely to do so. In contrast, email password recovery is an exception to the normal user flow.
- danenania 1y agoPassword reset also has phishing potential. I do see your point, but if a user doesn’t check domains, I think they can be easily phished through either route.
- jmull 1y agoI guess the problem is such people will mostly use passwords that are as weak as they can get away with.
- stronglikedan 1y agoGood luck finding a suite of modern, convenient services that will allow you to do that nowadays. I wish we could opt-in with some sort of I-know-what-I'm-doing-with-passwords-and-take-full-responsibility option.
- Wingman4l7 1y agoYou vastly underestimate the number of people who should not pick this option but would (because doing otherwise would be admitting their incompetence / ignorance) -- thus handily continuing the problem.