Hacker News Reader

You mean the guy who thinks you should email yourself your passwords to store them safely?

Do you have a reference for that? Was quite shocked by that and searching his site found a couple of sensible articles about security, but nothing about emailing yourself your passwords. May just be that my google-fu isn't good enough.

Second to last paragraph: http://www.codinghorror.com/blog/2012/04/make-your-email-hac...

Presumably that is based on his assumption that once the web app receives an email via https and it is to a gmail user, they don't send the message via email (i.e. it never travels over an insecure channel). It may be a reasonable assumption, but seems a little strange to boast about exactly how secure it is.

The funny thing is that many sites does password reset via email anyway.

Most passwords resets do not mail you the password; they usually mail you a unique URL which you can use to reset the password, which often generates a second mail telling you the password was changed.

That prevents anyone from "sneaking" into your account, even if the can snoop your mail / copy your inbox. You'll see the intrusion, and you'll be unable to log into the service after the password is changed.

Storing the password in plain-text in your inbox has none of that protection.

Reply on news.ycombinator.com