Re: Example of the worst passwd recovery interface

[Javier Fernandez-Sanguino <jfernandez () germinus com>]

Yousef Syed wrote:

>  On the otherhand, you have sites (my bank is similar) that make
> password retrieval difficult/impossible. Though this could be
> inconvenient, I'd prefer my bank to deal with me in this manner.

Forcing users to retrieve passwords offline (i.e. going to the bank 
branch as somebody mention) when they get blocked is actually a 
security feature. It not only helps prevent against deploying insecure 
password retrieval mechanisms, it makes online attacks much more 
difficult (somebody has to physically go to the branch, get recorded 
on a camera while he is in, etc. and an attack cannot be fully automated)

Just my few cents

Javier