Hacker News Reader

Comment by mattashii | Hacker News Reader

The point is that the most commonly used e-mail protocols do not have safety built in. The solutions for this problem (e.g. PGP signing) are not adapted widely enough to be considered adapted by the market.

If you'd want to use two-factor authentication by verifying access to the mailbox, you have to make sure that that (the connection to) the mail box is safe as well, which can potentially be very hard.

The mailbox still is a safe, but only from the moment that the mail has been sent to the moment the page has been requested. Mind that a safe connection to your mailbox does not also mean a safe connection to the server, but that is something that is covered by https+certificates (mostly).

View on HN

As elcapitan pointed out, if your email, or even the route mail takes to get to you, was compromised then an attacker would already have access to your accounts by simply forcing a password reset.

This is no worse a security footprint than the existing, requisite "Forgot Your Password" flow. It's the exact same security footprint.

TLS is already an under-spoken requisite of SMTP communications from any webserver doing "Forgot Your Password" workflows. TLS between mail servers is also already a de facto SMTP requirement for most bare minimum spam fighting mechanisms.

True that the password reset and the "login" using this proposal travel the same path and present the same attack vector but there is some disadvantage to the frequency in which the "login" system would travel down this less-than-secure path. The more times you use this the more likely that someone will just happen to be watching and waiting at the right time.

Let's not forget that most of the email system is still not encrypted (last time I checked anyway) even though the last mile between your mail server and your client may be.

Frequency is also essentially the same: you can request a new login token equally as often as you can request a new "Forgot Your Password" token in that they are both manually requested with only an email address.

There are also already a growing number of users that use "Forgot Your Password"-only login (most accidentally; human memory is porous) day to day.

Which is not to say that we shouldn't make email better and more secure, but that the security of our email infrastructure is a red herring of sorts in the larger security discussions of "passwordless" login, given that we are already equally insecure in every website that has a "Forgot Your Password" button that accepts anyone's email address.

An attacker who can "watch", can also click the "forgot my password" button whenever she happens to be watching.

Reply on news.ycombinator.com