Re:We replaced passwords with something worse
by moi2388 on Thursday August 07, 2025 @02:10AM
(#44821168)
It’s not slick at all. Passwords and MFA autofill, their image codes don’t, so I have to close the browser, go to email, copy code, delete email, go to browser, paste code just to login.
The entire email login flow is completely retarded. It’s not even secure.
Re:We replaced passwords with something worse
by vachina on Thursday August 07, 2025 @03:50AM
(#44821741)
It’s not just slick, it is “secure” on the get go by thwarting any password stuffing attempts (if your email is not pwned already)
Re:We replaced passwords with something worse
by const_cast on Thursday August 07, 2025 @11:22AM
(#44825677)
A lot of services just do this de-facto, where you only need an email code to reset the password. Which is equivalent to single auth with email.
Email link to reset is better, email link + another auth (usually sms) is even better.
Re:We replaced passwords with something worse
by eddythompson80 on Thursday August 07, 2025 @11:35AM
(#44825854)
Only in an abstract threat model sense. In real world phishing its pretty different.
Its super odd if you land on facebook.com-profilesadfg.info/login thinking its just Facebook and try to login but get a "password reset" email. Most people would be confused as they don't want to reset their password.
Having it for every login means that just missing the website URL, everything else is 100% legit.
Patreon can do that too, depending on how you sign up.