3 ms·
You may as well generate onetime junk password, feed it into persona and later rely on password manager to remember it for you. You should avoid reusing your p
by exo762 13y ago
You may as well generate onetime junk password, feed it into persona and later rely on password manager to remember it for you.
You should avoid reusing your passwords across sites. BTW Persona helps you with that.
- jimktrains2 13y agoBut my point is that you're still trusting your email provider with the password, and now if that get's leaked an attacker has access to (arguably/potentially) more sites than they would have before (via password resets).
- StavrosK 13y agoHow so? If an attacker gets your mail password, they can pretty much already password-reset every single site you use.
- Sami_Lehtinen 13y agoThat is exactly why sites shouldn't provide password reset by email. Email shouldn't be used for authentication in any case. It's really insecure solution.
- jimktrains2 13y agoUnfortunately security questions aren't much better. The best solution is to expect the user to safely and securely store a reset-key (kind of like Mozilla's Sync). However, to the average, non-techie user this is * Bad UX * They won't store it securely * They'll lose it Another option is using public keys with some form of transition mechanism.