Let’s talk about usernames

Re:Let’s talk about usernames by slavik81 on Monday February 12, 2018 @02:50AM (#16357191)

You don't need to make a system that's perfect. You just need to make a system in which checks are required to make _any_ change the credentials on an account. Once those checks are complete, it makes no difference if the change is from [email protected] to [email protected] or to [email protected].

[ Parent | on HN ]

Re:Let’s talk about usernames by Alex3917 on Monday February 12, 2018 @09:04AM (#16358579)

It’s not just password resets that are the issue. It’s also things like:

- Functions to get the account based on the email address

- Internal tools

- Stored procedures and other SQL stuff that happens outside the main code base

- Third-part integrations (Mailgun, Sailthru, ZenDesk, SalesForce, etc.)

That’s a huge attack surface where if there is even a minor mistake by a junior dev that no one noticed then everyone is going to lose their assets under protection.

[ Parent | on HN ]