3 ms·

A single point of failure means if they gain access to one account they have access to ALL of your accounts. For example, if someone breaks into your email and

by Nadya 12y ago

A single point of failure means if they gain access to one account they have access to ALL of your accounts. For example, if someone breaks into your email and you use that email for all of your accounts (banking, amazon, facebook, etc.) they can use email recovery to gain access to ALL of your accounts. If someone gains access to one of my accounts, every single other account is still secure because it uses an entirely different email & password that has no relation to any other email or password.

snowwrestler 12y ago
> If someone gains access to one of my accounts, every single other account is still secure All of your accounts are insecure from the start because a) you use passwords easy enough for you to remember, and b) you rely on email reset, which travels the public Internet in plain text.
- Nadya 12y ago
  Try checking your RCPT header next time. Create a throwaway Yahoo account and change the password. You'll find it's sent with 128 bit encryption over TLS. If using a Gmail account to recover, Gmail defaults to HTTPS. You'll find you're secure every step of the way. To call email insecure is to be rather outdated with advances in the past 4-5 years. Furthermore, nice assumption under 'a'. Mnemonics are a powerful learning device for memorization, I advise you look into them. The human memory is a powerful thing and committing several randomly generated password consisting of 20-50 characters it not "impossible". https://en.wikipedia.org/wiki/Grand_Master_of_Memory https://en.wikipedia.org/wiki/Grand_Master_of_Memory I do not remember my passwords. I remember mnemonics which help me remember my passwords. It's not entirely foolproof but it is far more secure than a single-failure-point system.
  - snowwrestler 12y ago
    Your password reset email might or might not travel over SMTPS. As an end user you have no way of knowing in advance or forcing its use, so it's not very trustworthy. I have no doubt you can memorize several very strong passwords, but there is a limit to how much randomness anyone can memorize. I've got over 100 passwords in my manager, counting both personal and professional accounts I need to keep track of.

by Nadya 12y ago

snowwrestler 12y ago

> If someone gains access to one of my accounts, every single other account is still secure All of your accounts are insecure from the start because a) you use passwords easy enough for you to remember, and b) you rely on email reset, which travels the public Internet in plain text.

Nadya 12y ago
Try checking your RCPT header next time. Create a throwaway Yahoo account and change the password. You'll find it's sent with 128 bit encryption over TLS. If using a Gmail account to recover, Gmail defaults to HTTPS. You'll find you're secure every step of the way. To call email insecure is to be rather outdated with advances in the past 4-5 years. Furthermore, nice assumption under 'a'. Mnemonics are a powerful learning device for memorization, I advise you look into them. The human memory is a powerful thing and committing several randomly generated password consisting of 20-50 characters it not "impossible". https://en.wikipedia.org/wiki/Grand_Master_of_Memory https://en.wikipedia.org/wiki/Grand_Master_of_Memory I do not remember my passwords. I remember mnemonics which help me remember my passwords. It's not entirely foolproof but it is far more secure than a single-failure-point system.
- snowwrestler 12y ago
  Your password reset email might or might not travel over SMTPS. As an end user you have no way of knowing in advance or forcing its use, so it's not very trustworthy. I have no doubt you can memorize several very strong passwords, but there is a limit to how much randomness anyone can memorize. I've got over 100 passwords in my manager, counting both personal and professional accounts I need to keep track of.