Hacker News Reader

Comment by jrockway | Hacker News Reader

Because you don't want your sysadmin logging into your favorite dating site as you?

If you are going to do this right, you need email encryption. In which case, you have a client-side certificate. In which case, you might as well just authenticate over SSL with that certificate.

But hey, why do something secure and built-in to every browser (even IE) when you can invent your own protocol instead? It's the Internet!

Also, any reason why this is an "Ask HN" and not a blog post? (Not saying it should be one or the other... just askin'.)

View on HN

Well, the sysadmin could click on "restore password" on that super-secret site they want to steal your password to, and then check your mailbox. So this is really no different in terms of security.

Also, I'm sure I have a dozen restore password emails in GMail somewhere. And I'm sure I'm not alone.

> I'm sure I have a dozen restore password emails in GMail somewhere

Maybe that should be the next Google Labs feature. The 'Mission Impossible' option. (i.e. 'this message will self-destruct')

Generally, password reset links will have a timeout associated with them. Also, if someone does manage to use the password reset link in your mailbox and reset the password before it expires, you will come to know that your password is not working anymore, and you can act on it. It's not same as someone silently logging into your account through your email. This doesn't in anyway mean that it's safe to send password reset links to your mailbox if it's already compromised, though.

How come people are not upset that the "forgot password" protocol is not secure?

People are upset about how insecure email password reset is.

It's worth noting that this is how 4chan users 'hacked' those Christian Facebook pages.

Database of Christian dating site logins -> Same password as email -> Same password as Facebook and/or use email to reset

Dating sites is an interesting example because OK Cupid does exactly this. They send occasional emails with a "Login Instantly" button which contain an authentication token.

In general, if someone can read your email, they can steal almost any of your accounts. Are email accounts generally that insecure? I trust any major Webmail provider to not steal my bank account, but is trust the only thing really keeping our bank accounts secure?

If we really are that insecure, then people are probably going to attack your bank account long before they attack your random web-app account. If your site isn't guarding valuables, it's probably perfectly "safe" to send authentication tokens in mail messages. No?

> If you are going to do this right, you need email encryption. In which case, you have a client-side certificate. In which case, you might as well just authenticate over SSL with that certificate.

Maybe I'm reading this wrong, but isn't most email encryption done with GPG/PGP or S/MIME? Where do client-side SSL certificates come in?

Reply on news.ycombinator.com