3 ms·
Yes. This just offloads the security burden from the Webmaker service to your email provider. It means one less password, but a compromise is still catastroph
by jordanpg 12y ago
Yes. This just offloads the security burden from the Webmaker service to your email provider. It means one less password, but a compromise is still catastrophic.
If the goal is to separate the need to remember complex passwords from the application, then a password manager makes much more sense (ideally with 2FA).
In the long game of improving token-based security, this is a step sideways at best.
- ncallaway 12y agoWith this method I'm not seeing how an e-mail compromise is any more catastrophic than a site that offers a "forgot my password" flow. That is to say, yes, a compromised primary e-mail _is_ catastrophic, but seems like an already accepted risk. Why is this worse?
- jordanpg 12y agoAssuming an email compromise is catastrophic, as pointed out earlier in this thread, one might as well use a password manager, which allows for maximal password strength, possibly 2FA, total control over the password database, etc. I didn't mean to imply that this was worse, only that it doesn't really change the threat.