4 ms·
I don't know if I'd call this "fantastic". It simply relocates the attack. Ostensibly, the thing that is improving security is having a stronger password else
by jordanpg 12y ago
I don't know if I'd call this "fantastic". It simply relocates the attack. Ostensibly, the thing that is improving security is having a stronger password elsewhere rather than those recycled ones that you mentioned, but this is not guaranteed and, I suspect, not the case in most instances. It's really like using an email account as a password manager.
- awendt 12y agoYou get sent an OTP that expires after half an hour. So in order to attack someone, you need to gain access to your victim's e-mail account beforehand. Which is quite hard if if the victim has MFA activated. If you gain access to your victim's e-mail account, even if you find any passwords in there, you cannot use any of them because they are not working anymore. So it's not only a stronger, non-recycled password. It's: 1. an OTP 2. that expires very soon 3. that cannot be recycled 4. in a place that's likely to be well-protected EDIT: 5. that place (#4) is in widespread use This is beyond a "password manager" which barely covers #3 (it incentivizes not to recycle) – and maybe #4, if you're careful.
- wilkystyle 12y agoAlmost all services have a "forgot password" link that will send a reset to your email account. The solution in this article isn't really "relocating" the attack... more like removing additional attack vectors and limiting it to the email vector (which already exists right now, anyway).