Opera used to be a fantastic web browser, with a custom high-performance Presto rendering engine and features like tabbed windows that didn't show up in competing browsers until years later. However, the modern Opera browser is a shadow of its former self, reliant on chasing trends and meme advertising to
Pretty much every service on the internet does password-reset via a token sent to your mailbox, so if someone gets control of your mail, you’re pretty much pwned anyway. It would be slower and more inconvenient for an attacker to reset everything individually, but I’m sure they can automate that.
This is just security theatre. Burning all my data makes my life a lot harder, but an attacker would barely notice.
If I can reset each individual credential via mail token, on the assumption that only the genuine owner has access to the mailbox, then I lose nothing by resetting access to the whole set of credentials via mail token, on that same assumption.
It’s only security theater because you have this kind of mentality:
It would be slower and more inconvenient for an attacker to reset everything individually, but I’m sure they can automate that.
then I lose nothing by resetting access to the whole set of credentials via mail token, on that same assumption.
You’re right that an attacker could reset everything if they had access to your primary email account, but 1) you should already have 2fa on that account to protect yourself, 2) losing access to your email would be a signal that something is wrong and gives you a chance to react before they have everything, and 3) there’s a world of difference between having credentials immediately vs having to jump through hoops to reset stuff. Also:
Burning all my data makes my life a lot harder, but an attacker would barely notice.
Burning all your data means your attacker can’t suddenly transfer the contents of your checking account away or buy all kinds of shit from trusted vendors just because they broke into one account. Security is about layered defense, not just giving the attacker keys to the kingdom because you couldn’t remember one password.
Pretty much every service on the internet does password-reset via a token sent to your mailbox, so if someone gets control of your mail, you’re pretty much pwned anyway. It would be slower and more inconvenient for an attacker to reset everything individually, but I’m sure they can automate that.
This is just security theatre. Burning all my data makes my life a lot harder, but an attacker would barely notice.
If I can reset each individual credential via mail token, on the assumption that only the genuine owner has access to the mailbox, then I lose nothing by resetting access to the whole set of credentials via mail token, on that same assumption.
It’s only security theater because you have this kind of mentality:
You’re right that an attacker could reset everything if they had access to your primary email account, but 1) you should already have 2fa on that account to protect yourself, 2) losing access to your email would be a signal that something is wrong and gives you a chance to react before they have everything, and 3) there’s a world of difference between having credentials immediately vs having to jump through hoops to reset stuff. Also:
Burning all your data means your attacker can’t suddenly transfer the contents of your checking account away or buy all kinds of shit from trusted vendors just because they broke into one account. Security is about layered defense, not just giving the attacker keys to the kingdom because you couldn’t remember one password.