San FranciscoOne developer’s compromise hit 1,038 upvotes.
Anyone whose account recovery funnels into one email or phone faces the same exposure.
A single compromised credential cascaded through single sign-on and password-manager recovery into every linked account.
Platforms that design those recovery flows still face no liability when they fail.
Sources: Hacker News