|
|
|
|
|
by WiF3cap7ShUth4
702 days ago
|
|
You can look at this https://sequoia-pgp.org/blog/2021/06/29/202106-yes-we-want-c... I quote a section that corresponds to my situation >Email is everyone’s primary trust anchor online >If a user loses access to an online account, most services have an account recovery mechanism that will let the user back in. Usually, this works by sending an email to the user with a one-time password. >If an attacker compromises a user’s email account, they can use the same mechanism to gain control of the user’s account on any service that uses the email account as a trust root. In practice, that’s most of the user’s online accounts. Unfortunately, two-factor authentication only offers limited protection. It is opt-in and usually uses a phone number, which is easily hijacked. >If account recovery emails were encrypted, the trust anchor would instead be the encryption key. Since the encryption key is stored on the user’s computer, this would defeat this type of attack. |
|