[repelsteeltje]

> Once a hacker gains access to a Facebook account, they can proceed to activate email encryption.

> This renders recovery emails sent to the user’s email address unreadable, as only the hacker has the encryption keys.

So: PGP encrypted emails were rarely used, except to lock out the legit user after account was compromised.

[sebstefan]

Github asks you to log in again to add SSH keys in, this could've been similar

They're just looking for excuses

[crtasm]

A lot of account compromise is due to reused passwords so I'm not sure that's a complete solution.

[Kwpolska]

Sending a PGP-encrypted email with a verification link to activate the feature should solve that.

[westurner]

What are the disadvantages of only signing (and not encrypting the message body of) account reset emails?

[sebstefan]

The point is that much more sensitive things exist online and it's a solved problem

[jhanschoo]

What use case for FB relies on this feature?

[martin_a]

Almost sounds like a feature. :-)