What would be nice would be if all sites supported this system:
1) go to site 2) enter email address (cached by the browser) 3) go to email account 4) click on long, unguessable link which is only valid for 2 minutes)
er..that's it.
You could even skip the `enter email address` step and just get users to keep a link provided in the initial signup process. This link could either be the one you always use to log in, or for better security could prompt the remote site into sending you another single-use login link (as above).
Well most sites do support the feature. It's called password reset and I use it heavily in fact.
I use keepass, but sometimes for services that I use once per year, I just go via password reset and change password to a long random gibberish and do not even bother to write it down to keepass.
No, it's nothing like password reset. My proposed system doesn't even need a password.
Re:Two-factor paper passwords
by nommm-nommm on Tuesday May 03, 2016 @07:19PM
(#11624995)
This is how Craigslist posts work. You can create a password if you want but you by no means need one. You don't even have to "create an account."
>Your email address, in most cases.
I have accounts with, like, a bazillion different financial institutions. They all require user names that have length requirements and special character/number requirements. I would forget all my user names if it weren't for password managers.
If you have one bank, no 401k, no IRA, no credit cards, two social media accounts, one email address, and do all your online shopping on Amazon, and not much else this sort of disadvantage won't pop up but once you get into multiple accounts on multiple sites it does not scale.
If you have many password schemes you'd also have to remember the password rules for every single site.