Hacker News Reader

If they can hack into your mail they can reset your password anyway.

(I'm not being technically correct here, but I'm being practical, and my argument here applies to 99.9999% of all cases)

View on HN

It's not about hacking your email even. A significant amount of SMTP traffic still goes around unencrypted so just seeing that traffic fly by is enough to get the password.

A one-time password system should also have a second token that was sent to the browser as a cookie over SSL. When the link is clicked the browser sends both tokens (the cookie and the OTP) together. The password is only valid for one browser. Also the OTP should expire after a short time. [1] It has the same security properties as a federated identity service like OpenID (except that it is less vulnerable to phishing.)

Of course if you're talking about just a normal plain text static password, then it's obviously wrong to see it in an email.

[1] "Simple Authentication for the Web" (2007) https://isrl.byu.edu/pubs/saw_TechReport%20%28revised%20Marc...

Reply on news.ycombinator.com