alt Hacker NewsBonus-rage if the exploitable "recovery" path relies on "Security Questions" you cannot change which are not-really-very-secret and which overlap with the same questions recorded (and leaked) by other companies.
Bonus-rage if the exploitable "recovery" path relies on "Security Questions" you cannot change which are not-really-very-secret and which overlap with the same questions recorded (and leaked) by other companies.
At least those you can turn into covert password fields because they cannot verify them.
Phone numbers they 'verify' so you cant just put in a uniformly random 10 digit number and authenticate later through knowledge of it.