With all of these recent breaches, I have been thinking about security best practices.
One thing I was thinking about was the fact that some sites allow you to log into a site using your EMAIL OR USERNAME, or even JUST EMAIL.
To me, this sounds like a big risk, because you are now given 2 separate vectors to attack from, one from knowing the email, or one from knowing the Username.
But lets take this a step further, and assume we don't know the email, but do know the Username.
Lets say their password was cracked, and someone is in the account, which gives the attacker access to the user's "Registered Email Address." Or even if the attacker was able to SQLi the site's database and were able to get a list of email addresses and username/pw combos. This means the attacker can now do a lot of damage over a wide area.
With email listed, attackers now have access to new data that previously was not known. Assuming these people aren't smart, and reuse their passwords, a hacker now has access to their email account. Even if they didn't reuse their password we now have an email in order to start attacks.
From there, we also have 2FA, which I'm not 100% how it works, but it seems to require authentication by using your mobile device, either a code or some sort of login from the device.
The thing is, I've heard that if someone sets up 2FA on your account, you can be locked out.... So what use does your email have now, besides providing additional information about you, that you really do not need.
My questions are.
Is providing an email address these days actually useful, or is it a security risk due to providing additional information that could be harmful?
If 2FA is enabled, and we get locked out of our account, would our email be able to save us? It seems 2FA has a higher permission level than the normal password reset of an email, so even if you did reset your password, the 2FA would not allow you in (granted I'm not sure how to reset 2FA).
Since an email address' only function (usually) is to provide a way to reset your password, it seems to me, that if we register an account, and then set up 2FA on a mobile device the email address is really not needed. Password resets could be sent to that 2FA device, so that it could change your password, without ever having to send it to an email... (not sure if this is done now, but figure this could be implemented).
So am I wrong to think that Emails are dangerous to provide these days, and that we could possibly accomplish what we want with just 2FA?
EDIT: I just want to point out, that the above was written under the assumption that email addresses/usernames are not Hashed. After reading a few questions on here regarding hashing emails, it seems some people do it.
I'm curious how many people recommend hashing an email address? What about a username?
Personally I like hashing as much important data as I can, but not sure what "Security best practices" are, or what a lot of people do.