4 ms·
Seems to be punting a lot of the security responsibilities regarding the Magazine to the user and email provider. Clever, but perhaps too clever by the half.
by Kylekramer 14y ago
Seems to be punting a lot of the security responsibilities regarding the Magazine to the user and email provider. Clever, but perhaps too clever by the half.
- lwat 14y agoI don't see how this is any different to every site with a 'reset my password' link
- Kylekramer 14y agoAnd I have the same opinion of those sites whose only security is sending reset links to a user's email. But at least with those you don't have to hop back and forth between your email and the site anytime you use a different device or browser.
- bigiain 14y agoPerhaps, but in this particular case - that's probably a perfectly fine trade-off. The "worst case" exploit of this scheme seems to be that someone other than a subscriber gets to read the Magazine. The marginal costs to Marco for that occasionally happening are practically zero - someone who is prepared to steal passwords or read other peoples email accounts to get access to a website was super-unlikely to ever become a paying subscriber anyway. Marco has made it easier for the people who are/might be paying subscribers, and the tiny cost to him of potentially serving up his content to people who steal credentials from real paying subscribers. Since that cost is so low, and the added convenience is of value - why would he _not_ choose this? (Hell, even if the only result of this scheme was this discussion on HN, I bet it'll turn out revenue positive in spite of the increased fraud risks...)