Re:Password-less login
by demonshreder on Saturday March 11, 2017 @09:36AM
(#13845523)
>The difference here is that if/when someone uses their (unauthorized) access to my e-mail account to reset the password for this service, I will notice the next time I attempt to log in.
I am assuming the indicator would be an email from a service stating password reset but if the person has access to your email account, the obvious thing to do would be delete such an email. There is no difference.
Passwordless login is basically piggy backing on the security of the email account. You'd have to login to a site anyway but you are just logging in to your email which is assumed to be protected better.
I think OP meant that he will clearly realize if someone used his email account to reset his password because next time he tries to log in his old password will no longer work. However with passwordless authentication, someone with access to your email account could issue your account for potentially a long period of time without you noticing. You would still be under the impression that your account is secure.
> Rebuttal: This is possible in a password-ful login setup via the forgot password flow. Sometimes there are additional “security questions” but this is typically easily found information.
The difference here is that if/when someone uses their (unauthorized) access to my e-mail account to reset the password for this service, I will notice the next time I attempt to log in.
In an ideal world, one could prevent another from gaining access to an account, service, etc. When you can't prevent something, the next best thing is detection. Here, you've just removed the ability for a user to detect that their account is compromised -- and worse, you're trying to spin it like it's a good thing.
Also, greylisting.
Also, what if I wanted to log in to my account from my phone or a mobile device? I choose not to receive e-mail on my phone (only alerts/notifications) and I'm certainly not the only one.
It sounds like someone pitched this idea at a meeting ("Hey, I know! No passwords!") and the next 10 minutes was spent rationalizing all its problems away before declaring it as the one true solution.