4 ms·
"Send forgot password link to email account on file" is fairly common; if the user loses control of their email (e.g. to an attacker that got access to their pa
by cbhl 13y ago
"Send forgot password link to email account on file" is fairly common; if the user loses control of their email (e.g. to an attacker that got access to their password and then immediately changed it) then the user is already screwed in many ways. (I don't think this is ideal, but it seems to be the norm.)
Using email login links instead of passwords doesn't seem especially worse wrt. security than "industry standards".
- deong 13y agoExcept currently, I know most of my passwords. Losing my email access would suck on so many levels I don't know where to start, but at least I can still log into my bank/credit card sites/etc. to start mitigating the potential damage. If everyone went to a system like this, losing your email means losing access to everything you don't have an active cookie for, instantly and with no ability to recover.