Re:Yahoo wants to let you forget your Yahoo password
by oscarhong on Monday March 16, 2015 @09:23AM
(#9211226)
The problem here is that for Android and iPhone, I have the option to lock down the device using Android Device Manager or Find My iPhone.
However, I can still pull out a SIM card and put it on a different phone.
That's the difference.
Re:Yahoo wants to let you forget your Yahoo password
by datalink on Monday March 16, 2015 @09:58AM
(#9211422)
The SIM card is pin-locked. If not, you have as big or bigger problem at hand.
Re:Yahoo wants to let you forget your Yahoo password
by falcolas on Monday March 16, 2015 @12:44PM
(#9212529)
Your wireless provider can't/won't deactivate a SIM card if the phone is stolen?
Re:Yahoo wants to let you forget your Yahoo password
by shanecleveland on Monday March 16, 2015 @03:34PM
(#9213769)
Agreed. You are only ever as secure as your weakest link. If someone else has your device that is not protected by a pin and you are not able to remotely wipe or lock, then you probably have bigger problems.
I like seeing these sorts of solutions put to use. It will be even more user friendly with the use of Apple Watch, as an example, if you are accessing your account on something other than your phone.
Now, email is a pretty important thing, so it may not be the best place to experiment with new login methods. I like the way searchpath.io uses email authentication, rather than passwords, and I am implementing something similar for a side project.
When you lose your password to an account, how do you reset it? With your email (in the case of Yahoo, with your backup email). Which, if someone has your unlocked phone, is likely already compromised as part of the unlocked phone.
Sending an OTP via SMS doesn't really open up any new avenues of attack, if they already have your unlocked phone.
Now then, if you're displaying all text messages via lock screen, why have a lock screen at all? Sure, it protects the rest of your phone from intrusion, but it's leaking what should be considered private information to anyone who has it. You're probably also getting email summaries, chat summaries, and upcoming meetings as well.