3 ms·

You kind of do, since you can reset pretty much every password using email.

• cperciva 18y ago
  Only the ones which have password reset mechanisms. My bank doesn't, for example, because they realize that intercepting someone's email shouldn't allow an attacker to get access to the victim's bank accounts -- but that wouldn't help me if I used the same password for my bank as I did for 37signals.
• tetha 18y ago
  I think the point kind of is: If the plain text password (which is reused on multiple sites) is sent out via email, then you need to compromise a single email in order to compromise many accounts. If you want to abuse pasword-resetting mechanisms from N sites, you have to compromise N emails. This means: mailing the password in plaintext might result in a lucky attacker seeing the password over your shoulder and then, he has access to a lot of stuff. If he just sees a password reset link, he has seen nothing. Of course, this includes compromising the account, because once the account is compromised, an arbitrary amount of emails is compromised (and thus, of course, also 1 email and N emails).