Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

> Email isn't used for auth?

I didn't say that, you added that part. It is used for auth. it isn't secure.

Email is less secure than SMS, unless you encrypt your email (even then..). With email, there are multiple middle parties that can just read the message. Forget malicious insiders, it is more than reasonable to assume at least one MTA out there is compromised. Mail server CVE's aren't that rare.

Furthermore, despite email being used for auth, as you correctly claimed, email clients aren't secured like authentication applications or password managers are. For most people, a compromise of their email account means a compromise of most of their other accounts.

Even furthermore, not only is email used for authentication, email is being used to revoke,reset and tamper with other authentication methods and account security in general. You don't just login to apps via email, your password, MFA, account changes,etc.. can all be done by someone controlling your email (and more and more, your phone number/SIM these days).

End to end encryption is all the rage on sites like HN, but I'm shocked when those same people have no problem using email for sensitive operations.



Sms travels through air, so it's less secure.

Also email is usually encrypted, MTA are application layer, not routing layer, and they can onlu see headers.

2fa is nice, but the first factor is usually email.

But whatever, maybe the world is wrong




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: