XMPP Service Operators - 2022-01-02

> Re-reading https://thomas-leister.de/en/password-resets/ what's the ecosystem feeling about this? I do prefer in-person talk to verify informations. It can be done by XMPP (another account for example) or by email. It works well because we don't have too many accounts on our service, of course.

That's not really doable with a public server is it? Or at least not helpful

I think it's the simplest way to maximize security but also user's frustration. I believe there are good alternatives like: - warn the user by any mean of the current request and allow cancellation - add extra delays to the procedure (eg. 7 days) - allow the user to configure the security level. But this comes with additional work (and flaws?) for the admin.

moparisthebest: perhaps the more fundamental idea there is just "have *some sort* of relationship between the user and service-operator, beyond just that service itself"?

or, everyone should run their own server

...on their phones!

D:

moparisthebest: Well, the usual relationship I recommend people pursue for most services is the "paying customer / paid support" relationship.... But "self" is also a relationship....

But usually I'm making that recommendation within a context like: a friend is saying "someone else got control of my Yahoo! e-mail account and changed my password! What should I do!"

Bend over and kiss your Yahoo account goodbye

moparisthebest: that particular person ultimately decided "Well, somehow I still have access to use my e-mail through the app on my iPhone, I just can't change my password or log in from my computer..., so I'll just only do e-mail from that one device from now on—and when I trade up for a new phone, then I'll get a new Yahoo account".

Learn how to steal it back, or become paying customer of someone who can.

Users make very confusing choices sometimes.