Re:A future without passwords
by mindslight on Friday May 07, 2021 @01:08AM
(#27072397)
Every time I log in, ebay bugs me to confirm my phone number "for security purposes". I say no, because I know the next step is harassing me with text messages every time I want to log in (like Google, etc). Passwords work for many of us. I generate them with pwgen(1), store them in a text file on encfs, and cache them in browsers. If my actual desktop computer ever got pwnt, I would have much bigger problems than a Gmail account or even online banking. This might not match the security model of people who reuse passwords across sites, and/or log into accounts on public computers (derp), but it is the original security model of the web and it's extremely frustrating that companies are attempting to destroy it in favor of some magic (read: unpredictable) new system that continually gets in your way.
[ Parent
| on HN ]
eBay would not flip on two factor without you knowing. Likely it is to alert you of a new device accessing your account and possibly part of a password reset flow.
Itβs a good point though β how munch more secure is two factor if you have an unguessable password locked away in a password manager. Your single point of failure is security of your computer.
Re:A future without passwords
by mindslight on Friday May 07, 2021 @09:45AM
(#27075764)
But this is exactly what Google did to me - rejected using my perfectly good password in favor of "two factor" authentication consisting of my recovery email and some saved browser session (which no longer exists as I periodically wipe browser sessions). Plus the countless number of websites (usually online banking) that abuse your phone/email to send you a code for every login, having been spoiled by the mobile-surveillance environment. So I really can't trust that eBay wouldn't start doing something similar.
And yeah I do get the idea that if my password is actually compromised and hostilely changed, I'm going to be looking at the company for some sort of reset. But the right way of doing this is a higher friction process that could require phone engagement, in person notarization, etc. It's certainly not to make this reset process part of the every day login experience based on this mistaken idea that passwords are always insecure.