> it doesn't matter when some user will create a reset request. Because you can do it for him, right?
only if I know the user's email address for this given service.
with your system the attacker will get a regular flow of emails like this, and can even just track the emails as they're used, so as to then use them later to create a new authenticated session without arousing the suspicions of the user.
even if an attacker was lucky enough to capture a password reset email, they either have to use it immediately (or it will become invalid) or do a later, second password reset. Either way, the user still knows at the very least that something isn't right.
> There are tons of services out there generating a password for you and sending it over in plain text
and this is fucking atrocious from a security stand point.
> Do we see it heavily abused? The opposite is true - those services are more safe because they got rid of reused passwords.
Care to name some? I'm not aware of any major service, website or application that relies on a OTP via email for primary authentication.
> Still vulnerable to more targeted attacks (enter username, wait for email, reuse cookie), but so "reset password" is.
You still don't seem to accept that knowing your account was compromised is a security feature. With your system there is potentially ZERO indication to the end user that their account has been compromised. That is FUCKING TERRIFYING to me, and that it isn't to you, is even MORE FUCKING TERRIFYING.
Please stop making claims as if you have any fucking idea about security.
only if I know the user's email address for this given service.
with your system the attacker will get a regular flow of emails like this, and can even just track the emails as they're used, so as to then use them later to create a new authenticated session without arousing the suspicions of the user.
even if an attacker was lucky enough to capture a password reset email, they either have to use it immediately (or it will become invalid) or do a later, second password reset. Either way, the user still knows at the very least that something isn't right.
> There are tons of services out there generating a password for you and sending it over in plain text
and this is fucking atrocious from a security stand point.
> Do we see it heavily abused? The opposite is true - those services are more safe because they got rid of reused passwords.
Care to name some? I'm not aware of any major service, website or application that relies on a OTP via email for primary authentication.
> Still vulnerable to more targeted attacks (enter username, wait for email, reuse cookie), but so "reset password" is.
You still don't seem to accept that knowing your account was compromised is a security feature. With your system there is potentially ZERO indication to the end user that their account has been compromised. That is FUCKING TERRIFYING to me, and that it isn't to you, is even MORE FUCKING TERRIFYING.
Please stop making claims as if you have any fucking idea about security.