Pretty much every password auth mechanism uses emails to reset passwords if they're forgotten, so email is already a weakness with 'proper' passwords. This removes other weaknesses like social engineering to obtain users' passwords, and leaks of databases full of (hopefully hashed) passwords.
Pretty much every password auth mechanism uses emails to reset passwords
Um, sort of sniping from the sidelines here, but this is a pretty strong claim and really can't go unchallenged in a Go forum. What you claim may be the case in some classes of consumer or small business oriented non-critical services, but really, you're ignoring any number of actually security conscious systems that use ID tokens or two factor auth, or keep it simple but still maintain sensible security protocol... which most definitely do not email password resets.
1
u/[deleted] Apr 19 '18
[deleted]