[overcast]

Passwords can already universally be recovered through email. I wish ALL sites had this feature. It's essentially a one time password, that expires.

[choward]

Exactly. The only password that really matters is the one for your email. Everything else just provides additional attack vectors.

[dogma1138]

That only works for services that do not store any sensitive data and employ costumer controller encryption, if your password is used as a cryptographic tool then it’s out of the question to use such mechanism.

[choward]

Then how would you be able to reset your password? All I'm saying is that any service that allows password resets shouldn't have passwords at all.

[vxNsr]

Whatsapp has figured out a solution to this problem. i.e. what is your Whatsapp password?

[PappaPatat]

Your telephone number. So instead of something you know (password), they use something you have (phone).

[cozzyd]

Yeah, but be careful never to use an email that you might lose access to (which in principle, could be any email).

[overcast]

What's the difference? They'll just recover your passwords either way. Secure your email password, use two factor authentication. Now you're more secure than just about any website you're using.

[cozzyd]

Well, for example if you're a student and you have [e-mail], you might lose access to that account after you graduate.

[dogma1138]

And providers like GMail can ban your account without warning or recovery options.

[overcast]

Same issue applies if you forget your password to any site.