undefined | Better HN

0 pointsmichaelmior4y ago0 comments

This is of course implementation dependent, but ideally a recovery key is single use. You should also be notified by email or some other channel that the recovery key was used. Then you are immediately aware if this use was unauthorized and you can take appropriate action. This type of response is not possible for unauthorized password use.

0 comments

2 comments · 1 top-level

em-bee4y ago· 1 in thread

you can get notifications for logins from a new device. isn't that just as useful?

michaelmiorOP4y ago

I think there's at least a couple ways these are different:

1. It's easy to start ignoring such notifications if you regularly log in to new devices (or if logins expire). I don't think this is true to the same degree with notifications of recovery code usage.

2. Devices can potentially be spoofed.

j / k navigate · click thread line to collapse