back

by anderspitman·7y ago·view on hn ↗
Would you mind linking to where you originally made that comment? Sounds like it might be a relevant conversation I should read.

I feel like you're making two somewhat contradictory arguments. The first is that this is inconvenient in several specific situations. The second is that passwords aren't a problem because people should use password managers. But the specific situations you mention are exactly the situations I've encountered in the past where my password manager isn't available either (which you acknowledge).

I do agree though that these are real problems. One advantage of using short-lived random keys for the emails is they could be short enough to manually enter (shorter than a secure password). Obviously you'd need to implement rate-limiting on the login page to prevent people from brute-forcing outstanding logins.

2 comments
The original comment was made here (but no other comments are in the thread): https://news.ycombinator.com/item?id=20418196
> But the specific situations you mention are exactly the situations I've encountered in the past where my password manager isn't available either (which you acknowledge).

I assume by "specific situation" you mean, "when I'm on someone else's computer."

Does your password manager not offer a web vault? That's what I use when I'm on someone else's computer and don't have my phone with me.

Yeah basically I was referring to the situations mentioned above. Someone else's computer, private browser, etc.

But then don't you have to login to your web vault? Why not just login to your email? Unless a web vault is something specific I'm not familiar with that makes it simpler.

EDIT: Didn't realize parent was not same person as great-grandparent.

Well, yes, at some point I have to login to something.

However, my email password is stored in my password manager. I can't login to gmail unless I login to my web vault first.

If a third service requires me to click a link in my email, this becomes a semi-rediculous three steps: web vault → email → other service.

Ah yes that makes sense. I wasn't considering that because my email password is one of the few I have memorized.
You would enter your master password on a device that you don't control? Are there any limits to this which would cause you to think twice?
No, I'd burn a one-time use password that I've set up for such purposes.