Re:Password-less login
by megous on Friday March 10, 2017 @06:26AM
(#13837810)
E-mail is good enough for me as a channel. But the service should allow me to upload a PGP pub key and use it for all further communication, no exceptions (including password resets, etc.).
That would secure the channel and the website would be able to trust that whoever is clicking the reset link is the owner of the key.
It would also be a nice second factor. You have to have access to the email account and to the private PGP key. And it is a second factor I can fully control, unlike SMS. And it's simple and cheap for the service.
That would secure the channel and the website would be able to trust that whoever is clicking the reset link is the owner of the key.
It would also be a nice second factor. You have to have access to the email account and to the private PGP key. And it is a second factor I can fully control, unlike SMS. And it's simple and cheap for the service.