Is there more of a security risk by providing an email when creating a new account?

Question

With all of these recent breaches, I have been thinking about security best practices.

One thing I was thinking about was the fact that some sites allow you to log into a site using your EMAIL OR USERNAME, or even JUST EMAIL.

To me, this sounds like a big risk, because you are now given 2 separate vectors to attack from, one from knowing the email, or one from knowing the Username.

But lets take this a step further, and assume we don't know the email, but do know the Username.

Lets say their password was cracked, and someone is in the account, which gives the attacker access to the user's "Registered Email Address." Or even if the attacker was able to SQLi the site's database and were able to get a list of email addresses and username/pw combos. This means the attacker can now do a lot of damage over a wide area.

With email listed, attackers now have access to new data that previously was not known. Assuming these people aren't smart, and reuse their passwords, a hacker now has access to their email account. Even if they didn't reuse their password we now have an email in order to start attacks.

---

From there, we also have 2FA, which I'm not 100% how it works, but it seems to require authentication by using your mobile device, either a code or some sort of login from the device.

The thing is, I've heard that if someone sets up 2FA on your account, you can be locked out.... So what use does your email have now, besides providing additional information about you, that you really do not need.

---

My questions are.

1. Is providing an email address these days actually useful, or is it a security risk due to providing additional information that could be harmful?

2. If 2FA is enabled, and we get locked out of our account, would our email be able to save us? It seems 2FA has a higher permission level than the normal password reset of an email, so even if you did reset your password, the 2FA would not allow you in (granted I'm not sure how to reset 2FA).

Since an email address' only function (usually) is to provide a way to reset your password, it seems to me, that if we register an account, and then set up 2FA on a mobile device the email address is really not needed. Password resets could be sent to that 2FA device, so that it could change your password, without ever having to send it to an email... (not sure if this is done now, but figure this could be implemented).

So am I wrong to think that Emails are dangerous to provide these days, and that we could possibly accomplish what we want with just 2FA?

---

EDIT: I just want to point out, that the above was written under the assumption that email addresses/usernames are not Hashed. After reading a few questions on here regarding hashing emails, it seems some people do it.

I'm curious how many people recommend hashing an email address? What about a username?

Personally I like hashing as much important data as I can, but not sure what "Security best practices" are, or what a lot of people do.

Answer 1

Neil has good points. I would like to add some more thoughts.

First: 2FA is a more generic term. Your smartcard, fingerprint scanner and iris scan also add a 2nd factor to 2FA. What you are talking of here is 2FA with OTP, one time passwords. And again with OTP there are many possibilities.

OTP possibilities

There is this cheap way of sending SMS or the cheap way of using your smartphone as your OTP generator. The OTPs are nowadays (there are still some like RSA and Vasco who refuse to adapt) according to RFC4226 or RFC6238. In both cases your device and the backend (site) have the same symmetric key. The key and some kind of moving factor like the keypress (RFC4226) or the time (RFC6238) are combined into an HMAC-SHAxxx algorithm. Using SMS is a bad idea as you saw during the last weeks but also using the Google Authenticator has its disadvantages.

But there are also hardware devices of many different vendors. Google and Facebook will not use those naturally. But sites or portals with some kind of defined or restricted userbase might use such devices. The Yubikey can even be initialized, so that the vendor does not know the symmetric key.

Losing an authentication factor

A user can lose or forget an authentication factor. Either forgetting his password or loosing his possession factor. If you have no workflows installed so that the use either may reset his password or revoke and reenroll a possession factor, than of course the user cannot login anymore. Never again. ;-)

You are right and Neil point with the credit bureaus. The challenge indeed is, to define a secure workflow to reset the password and reenroll a new hardware-token or register a new smartphone. This is why there are management systems for 2FA like these of classical vendors like Safenet Authentication Manager but also open source solutions like privacyIDEA (Disclaimer: I am working on the second one.) These management systems already provide workflows to revoke or delete possession factors and verify the identity.

Forgetting password

As far as losing the password is concerned, the email reset functionality is IMHO legit. The user can reset one forgotten knowledge factor with hopefully another good knowledge factor (the password of his email account).

Of course the problem arises when the user uses email on his smartphone (with cached password) and the Google Authenticator. Loosing the smartphone will compromise both factors! As the finder (or thief) get the possession factor and can reset the knowledge factor!

But it is also difficult to avoid the user writing his password on a sticky note under his keyboard.

Losing possession factor

The user loses his smartphone. Either with SMS or Google Authenticator. Or his hardware token. What will happen? First the user has to notify the administrator/site, that he lost his possession factor. The site will lock or revoke this factor, so that it can not be used anymore.

Now it very much depends on how you setup the process. Never send a QR code for the google authenticator via email to the user. In this case your 2FA would be reduced to 1FA as you already realized. The attacker could request a password reset and a smartphone reset on the same (hacked) email address.

The company/site should choose a good process. A simple way is that you can work with emergency codes like the PAM module of the Google Authenticator. Print 5 one time passwords as emergency possession factor. These can be stored "save" offline. If the smartphone is lost, use these to login.

The above mentioned management software can assign several factors to one user. E.g. if the user normally uses a dedicated hardware token to authenticate, he could also have smartphone receiving text messages and only use this second factor to reenroll a hardware token.

Or - not very sexy for Google and Co - the site can send a new authentication device or a new QR Code or some tricky registration codes for registering a new mobile phone for text messages to the postal address of the user.

Bottom line

The sense of 2FA is to raise the hurdle for the attacker. Classical attackers are good in online-software-attacks. They know how to attack passwords on a large scale. This is why text messages or the enrollment process of a google Authenticator are problematic. These are in the same realm of the skill profile of the attacker.

An now you see, why using credit bureaus or postal letters is attractive, since the attacker does not like going to the post office and it just does not scale.

Answer 2

The biggest danger is password reuse. Passwords should never be reused across sites. At the very least the most critical applications like your E-mail account should have a unique password.

The E-mail is especially sensitive. If a hacker breaks into your E-mail, he can find a lot about you, he can see which sites you visit and also reset the passwords since he's in control of the E-mail.

As suggested above, the solution is to use a password manager.

My suggestion would be to also use E-mail forwarders. That is, aliases. To achieve this, buy your own domain name and host it yourself, rather than depend on some "free" E-mail service. Then create one alias per site where you want to register. The alias will forward to your real E-mail address, but you don't have to disclose it. You only disclose a forwarding address. It's a bit tedious but I think it's beneficial in the long run.

(Of course if you are lazy you could just set up catch-all E-mail but you will get more spam)

The idea is not to expose your real E-mail address. Instead you register every time with a unique address. Obviously when you start receiving spam on a specific alias, you will know which site has been breached. And you can revoke the compromised alias so you don't get any more spam.

Answer 3

The exact procedure for resetting 2FA is site specific, but most let you do it just by authenticating to the site and/or proving that you have access to an appropriate email address; either the email associated with the account, or a rescue email address. While, as you point out, this is a fairly low-security hurdle, sites allow this because it is a cheap way to reset your 2FA if you have lost your mobile device. More expensive alternatives to this involve having to pass an identity quiz (given by credit bureaus in the US) and having to present legal ID to a customer service person. Both of those options are expensive and require that the site knows your real identity. Something that may be OK for your bank, but not for Google or Facebook.

Regarding sending password resets to the 2FA device, this isn't always possible. For 2FA schemes that use text messages, this might work. But many sites use apps like Google Authenicator for 2FA. That app provides no means of messaging from the site to the 2FA device. In fact, Google Authenticator works in offline mode which totally prohibits

Besides being needed for password resets, emails are used for general communication with users. Is see no way to get rid of them. Users just need to use unique and strong random passwords, use 2FA whenever possible, and follow general secure practices.

Answer 4

Is providing an email address these days actually useful, or is it a security risk due to providing additional information that could be harmful?

Yes it is useful because it allows access to be regained to a system should a password be forgotten.

The weakness here is that passwords have been reused, not that the email address has been reused.

If 2FA is enabled, and we get locked out of our account, would our email be able to save us? It seems 2FA has a higher permission level than the normal password reset of an email, so even if you did reset your password, the 2FA would not allow you in (granted I'm not sure how to reset 2FA).

This is very site specific and depends on implementation. Sometimes sites have a long, manual user authentication process should a 2FA device be lost. E.g. Notifying the user that access has been requested to their account and then giving them a long period of time to veto this before the next steps of verification take place (e.g. proving your identity with your passport - of course the checks done depend on the security level of the site in question).

So am I wrong to think that Emails are dangerous to provide these days, and that we could possibly accomplish what we want with just 2FA?

Emails are used because they are convenient. Say you try to log into a site after a few years - you may have a different phone so apps like Google Authenticator can no longer provide your second factor of authentication. However, you are more likely to still have access to your email, even if that is protected by 2FA itself because you regularly log into it.

Solution: Use a password manager (e.g. LastPass, 1Password, Dashlane, etc.) and generate unique strong passwords for every site, enable 2FA for your email, enable 2FA for your important accounts and regularly log into them to ensure your second factor is still current.

Answer 5

This depends on the security of the recovery account. If you provide an email account that has been given out to sites, it is going to be riskier than if you just have an account with only the purpose of recovering the account. If your recovery email has a lot of spam emails then it would be better to create a new one for recovery. The security is only as good as the weakest link in the chain and if the link is weak it is best to omit it. That being said, a secure recovery email is optimal.