Timeline for How secure is the "no-password" login scheme?
Current License: CC BY-SA 3.0
3 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Nov 15, 2017 at 6:43 | comment | added | RLFP | Yes most password reset schemes are set such that you can recover access through an email address. But security questions are also widely used and allow a password reset. I am not in favour of these, but they do exist. Password guessing is in the username+password scenario valid, given that your username is not also a secret. However username+password has this weakness by design, temporary blocking can make high speed guessing very difficult (If you want a mitigation option). | |
| Nov 14, 2017 at 16:12 | comment | added | dandavis | don't most passwords allow reset from an email address? that says to me that passwords have the same vuln, plus guessing... | |
| Nov 14, 2017 at 10:17 | history | answered | RLFP | CC BY-SA 3.0 |