3 ms·
Storing a token isn't really much more secure than storing the password itself. (If I steal your token, I'm buying coffee with your account even though I don't
by eli 13y ago
Storing a token isn't really much more secure than storing the password itself. (If I steal your token, I'm buying coffee with your account even though I don't know your password. A token that authenticates account access is a password.)
But it seems much more secure (which, it turns out, matters) and it does somewhat protect people who reuse the same password everywhere.
- troebr 13y agoYou can invalidate tokens for a compromised phone. Well you can also change your password, but I'd rather revoke the access from my phone than have my password stolen. Some kind of validation mechanism before you order could be nice (like a screen lock), something you can do with one hand.
- osteele 13y agoMany services grant fewer capabilities to a session authenticated only by token. In the case of Starbucks, you can buy a coffee or even reload the card from the user’s bank account via the app, but you need the password and the web site to change the user's mailing address. Therefore, this vulnerability might enable an exploit such as draining your bank account into gift cards that I send to my address, whereas access to your phone and token would not.
- deleted 13y ago[deleted]