Why must apps require email? Why not only username and password?
I agree. username and password is much more robust to credential stuffing attacks.
Email verification protocol
11–20 of 151 posts
Re: Email verification protocol
#12Why must apps require email? Why not only username and password?
Because it's less expensive to send a few e-mails than to provide customer support to everyone who forgets their password.
Re: Email verification protocol
#13"There are privacy implications as the email transmission informs the mail service the applications the user is using and when they used them." Not really, as I can enter any email on a service login page that uses magic links for auth. The owner of that email will receive the login link but that doesn't mean they tried to login on that system.
Not really indeed. You're right that false positive are possible with such a system, but false negatives are not. That means that you're leaking information about when a user didn't use a service, as well as partial information about when the did (which you could combine with other data to tell you something meaningful).
Re: Email verification protocol
#14Why must apps require email? Why not only username and password?
Many applications need a way to contact a user (security breach, password reset). If one only has a username and forgets the password, there’s no way to reverify the user.
Re: Email verification protocol
#15Re: Email verification protocol
#16> User privacy is enhanced as the issuer does not learn which web application is making the request as the request is mediated by the browser. How can you avoid revealing the application through the `Origin` header?
The request is sent by the browser, not the webapp itself (ie. using xhr or fetch) so it doesn't have headers like "Origin" added.
Re: Email verification protocol
#17Re: Email verification protocol
#18Re: Email verification protocol
#19Why must apps require email? Why not only username and password?
Many applications need a way to contact a user (security breach, password reset). If one only has a username and forgets the password, there’s no way to reverify the user.
> If one only has a username and forgets the password, there’s no way to reverify the user.
Tough beans?
Re: Email verification protocol
#20Why must apps require email? Why not only username and password?
Without traceability, any app that can be used for abuse will be. (An HN reader used an anonymous mail service to send me some hate speech and tell me to kill myself within the last day. The service they used to do it obviously does not care, but also cannot do anything about it, because they don't know who used their service to do it.)