Hacker News Reader

Comment by jaybosamiya | Hacker News Reader

> As security people like to say, “put all your eggs in one basket and stick the basket in Fort Knox”

I'm not so sure I want to do that. The point is, even that single Fort Knox can be breached at some point, and if it is, then everything is lost.

I agree that nowadays, email is almost unanimously the way to verify a password reset, and hence all your eggs are already in one basket, but shouldn't there be further protections?

View on HN

> "I agree that nowadays, email is almost unanimously the way to verify a password reset, and hence all your eggs are already in one basket, but shouldn't there be further protections?"

A few of the major webmail providers offer two-factor authentication, so that's one option to enhance protection. Here's some information about how to enable it for Gmail, Hotmail and Yahoo Mail:

https://www.google.com/landing/2step/

http://windows.microsoft.com/en-gb/windows/two-step-verifica...

https://help.yahoo.com/kb/SLN5013.html

It doesn’t have to be an email acc. Persona doesn’t actually have any dependency on email. Addresses that look like email (user@domain.tld) are just used for namespacing. The only requirement is that domain.tld can assert that you control user@domain.tld.

https://developer.mozilla.org/en-US/Persona/Protocol_Overvie...

Like you say, email is already the basket, so there are only advantages in migrating (such as not leaving your passwords all around the web).

Reply on news.ycombinator.com