3 ms·
Anyone else concerned that there seems to be a permanent confirmation code for resetting pw sent in plain text over email? "Keep this code SAFE. Anyone with th
by voronoff 12y ago
Anyone else concerned that there seems to be a permanent confirmation code for resetting pw sent in plain text over email?
"Keep this code SAFE. Anyone with this code and your username can gain access to your account"
Where I'm from, that is a password.
- marcell 12y agoWhile I am not too familiar with how Stellar/Ripple work, I assume they are sending an un-encrypted version of your Stellar private key, or perhaps the equivalent of a bitcoin master private key [1]. I say un-encrypted based on their claim that the code + username can be used to gain access; typically sites will encrypt the recovery code with your password. Based on this, I conjecture that they decided in favor of usability in the usability-security tradeoff. [1] https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki https://github.com/bitcoin/bips/blob/master/bip-0032.mediawi...
- gdb 12y agoIn your settings, you can turn off recovery for this reason. The plan is to move quickly to two-factor.
- axman6 12y agoI'm not worried, I'm the only one with that code and even I can't access my account. What a trainwreck.