3 ms·
I'd love this for a special case -- account recovery. A system where your account is only as secure as a recovery email address and/or knowledge based authenti
by rdl 12y ago
I'd love this for a special case -- account recovery. A system where your account is only as secure as a recovery email address and/or knowledge based authentication and/or social engineering of an account-reset staffer is pretty insecure.
Front loading that on new account creation is pretty dumb commercially, though, especially for low end services or non-financial services. You should do something with trivial signup and then progressive authentication. A holistic risk thing vs. binary.
- alainmeier 12y agoAccount recovery is a great use case. Any mission critical applications for businesses should require more than security questions or a phone call in order to gain access to accounts. We agree that front-loading is not always the best solution and are working on systems to help firms with progressive authentication, too.