访问帐户链接与密码重置流？
这部分是一个安全问题，部分是用户行为的问题。
想象一下，您已经忘记了您不特别关心的帐户的密码。您想重新登录，但不在乎 不足以花时间重置密码。您可以请求登录链接，而不是重置密码。该链接活动15分钟，您可以使用它来访问您的帐户而无需重置密码。
我想知道这种方法的缺点（安全性或其他）是什么。显然，如果用户最终不记得他们的密码，则每次他们想要登录时都需要执行此操作。这听起来不像是IMO的最佳实践，但是我对这会引起任何有形的安全性感到好奇。
如果我的直觉是对的，这是一个坏主意，那么这个过程还有其他选择吗？我的本能是，最好的可行选择是优化此流程，以使用户尽可能无缝，但最终仍需要重置密码。
This is partially a security question and partially a question of user behavior.
Imagine you've forgotten your password to an account that you don't particularly care about. You'd like to log back in, but don't care enough to spend time resetting your password. Instead of resetting your password, you're able to request a login link. The link is active for 15 minutes and you're able to use that to access your account without having to reset your password.
I'm wondering what the downsides (security or otherwise) to this approach are. Obviously, if the user doesn't eventually remember their password, they will need to do this every time they want to login. This doesn't sound like best practice imo, but I'm curious about any tangible security concerns this creates.
If my gut is right and this is a bad idea, are there alternatives to this process? My instinct is that the best viable option is optimizing this flow to make it as seamless as possible for users, but that they will ultimately still need to reset their passwords.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
拟议方法最明显的缺点是基于电子邮件是一项不安全的服务。 这里有一个帖子来解释这。
大多数站点以多种方式将电子邮件的不安全感打击以重置密码：
并使用您建议的登录链接。如果不好的演员可以拦截电子邮件，他们可以快速轻松地登录用户。直到发生恶意活动之后，用户可能不会注意到这一点。
The most obvious downside to the proposed approach is based around e-mail being an insecure service. There is a post here that explains this.
Most sites combat the insecurity of e-mail for password resets in a few ways:
With the login link that you are proposing. If a bad actor can intercept the e-mail they can log in as the user quickly and easily. This is likely to go unnoticed by the user until after the malicious activity has occurred.