Two-factor authentication is far superior. But I might be willing to concede that one factor authentication (using something you have) is about as good as one factor authentication (using something you know). Especially since password guessing is at or better than actual practice by real humans in password selection and security.

Perhaps the other factor of 2FA is rather optimistically your yahoo username.

Somebody online would know my yahoo id, but only a microscopic fraction of online people would have physical access to steal my phone.

Someone who steals my phone would almost certainly have no idea what my yahoo login name is. I would have to look it up myself just to make sure...

The intersection would be close friends and family members, and if I can't trust them, then I'm totally screwed aside from mere yahoo groups login issues.

If Yahoo really thinks that, they have issues with security... oh wait, they do! :-)

Except this basically leaves the passwords in the hands of the companies. It's like Yahoo saying "you don't need a password anymore, we'll just create one on the spot for you".

That's not what I imagined for a passwordless world. I don't want the companies to basically keep the passwords for me. I'd much rather put my trust in fingerprint scanners or other biometrics.

You can't change biometrics, ever. You can spoof them, same as a text password can be cracked. They're HORRIBLE factors.

They won't even need to bother. State-level actors usually have access to the phone company networks.

I said I would write it up. I love the title: "Yahoo's On-Demand (In)Security." http://blog.atomicinc.com/2015/03/16/yahoos-on-demand-insecu...

I should submit it directly to HN...