The famous Mat Honan hack got me thinking about e-mail password recovery, and how any link in the chain can break all the links preceding it. In Mat's example, that link happened to be the last link, and the entire chain broke down.
Specifically, Mat used his GMail address as the recovery email for all his services, and used his Apple e-mail as the recovery address for GMail. Therefore, once his Apple e-mail account was compromised, GMail was compromised, and all of his services soon followed.
I understand the need for email recovery for web services in general. However, using an e-mail recovery address for an e-mail service sounds like adding a redundant link to the chain, doubling your points of vulnerability (now your attacker can hack into either your primary or your recovery email account). Also, what is the recovery email you use for your recovery email? Having a recovery recovery e-mail adds yet another point of failure, and when you finally stop the chain and don't use one, you could find out you're locked out of it just when you need it the most!
True, the attacker may not know the address of the recovery mail, but as Mat's case demonstrated, he can deduce it (in his case figuring out Google's obfuscated pattern, where they hide some of the characters). And if you make it hard for them to deduce, you're making it hard for YOU to deduce - most of us use a single E-mail address, and if you set up a special address only for verification purposes you are likely to forget it a few years after.
I had a couple of ideas:
- Don't use a recovery e-mail for your primary e-mail at all. Simply activate 2-factor authentication and make it your strongest link (which you should do with all your important services anyway).
- Use a friend's e-mail address. If you have a friend/family member that you know cares about security as much as you do (and thus has 2-fact auth set up as well), you could use his address. Now an attacker has to hack two people, and it's highly unlikely he'd even guess which mail he needs to hack - you however will probably recognize it immediately (I suppose you could fall out of touch with that friend after many years, so perhaps a family member is preferable here). You could even set each other up as mutual recovery enablers.
I'd love to hear your thoughts on my analysis.