I recently redeemed my Amtrak points for a free ticket and then needed to change the ticket which required a phone call. The gentleman on the phone asked me for my “points PIN” that was apparently required to change any Amtrak points reservations. I had never needed to change any points reservations before so I didn’t have one.

Amtrak’s solution? I could set a PIN, right then and there, verbally with the agent over the phone. No logging into my account. No email or text message confirmation. They didn’t even ask to confirm my DoB or address. Nothing. I had only given him my reservation number.

And not 30 seconds after creating my new PIN the same agent was then able to “verify” my identity/account by asking me... for my PIN.

Krebs wrote about this sort of problem with airline boarding passes back in 2015.

https://krebsonsecurity.com/2015/10/whats-in-a-boarding-pass...

Internet Archive copy of the IATA publication on boarding pass barcodes referenced in the Krebs piece.

https://web.archive.org/web/20120324074139/https://www.iata....

You can do the same thing to steal anyone's Delta Inflight wifi account to use wifi credit they've paid for and not used on a flight, just by knowing their email address.

Though that also sort of illustrates some of tradeoffs involved.

Historically, something like that might well have been handled by snail-mailing a default pin to the address on record for the account and telling you to call back after you received it.

Of course, the problem is that a lot of people these days would think that was really poor customer service.

Based Amtrak.

ridiculous

Having only a password is just fine for many sites. The real problem comes up when you have to show it as an identifier to a third party. If you don't ever need to do that, all you need is a password, not a username. (Auditability of login information within a company notwithstanding -- isn't really something a user can try to enforce, and it can happen in a variety of ways. As a user, at the end of the day, you trust the company with your credentials, and assume they secure internal access in some fashion.)

Imagine all you have is a password, and I come along to register, attempting to set my password to "hunter2". Turns out someone else has already used this. Do you allow me to continue or tell me the password is already in use? If its in use - great, I'll just log in using that other guys account!

Of course, you could let the site specify the password, which would work if they're long and random. But social security numbers are neither of those.

Nobody said they should let you choose your own passwords. We were comparing with SSNs, which are assigned to you, not chosen by you. You'd do the same with such passwords. And nobody claimed SSNs are appropriate passwords either.

>And nobody claimed SSNs are appropriate passwords either.

Except for the US government, and most banks, medical providers, and cell phone companies.

This is a good point - not all services need both identification and authentication.

I've noticed some sites using identification only (like the days of IRC), so you can have a consistent identifier to interact with people but a username isn't actually secure or owned. The converse should also be possible, in the same sense that a bank PIN is used to authenticate with no public identifier involved.

That said, for many offerings we should consider "a company employee" to be a third party. There are already employees with access to my data, but the outsourced call center employee who answers the customer service number probably isn't one of them, and I want them to be able to look up my account details without being able to impersonate me.