Either by sending a code to SMS or Email, you are able to sign into your account without ever needing to or being able to add a password. Why has this become a thing recently?
Side rant:
To make it worse, SMS is incredibly insecure. Nothing should send you codes via SMS, and if you have the option to use an authenticator app, do that. It’s atrocious so many banks only have SMS as an option.
The really dumb part is, the SMS codes are literally the same authenticator algorithm, but running on their servers and sent to you via an insecure medium.
And one little lapse in not paying a cell phone bill can cause you to lose your phone number, which then means you can no longer authenticate.
this is why I don’t like it and why I often advocate that countries should provide a secure email that you can come to an office in person if you can’t get to it. People get mad as if Im suggesting it should be the only email they have but what I really want is a guaranteed thing that is made as secure as possible and allows for real in person support to make sure you can get access or stop someone that somehow got access.
This shit drives me nuts. I’ve put in a lot of effort to secure my accounts but a number of them require SMS without any opt out. We have known about the risks of SMS plenty long enough at this point.
I never understood why SMS is insecure, are you saying it’s easy to intercept someone’s number? How would that even work without the SIM?
Getting a replacement SIM from the phone company is often shockingly easy, just a tiny bit of social engineering. And then you have access to the number and everything that 2FA “protects”
Veritasium did a great video on it. Anything I can say about it will be 10x worse than that video.
It is but only if you are targeted. I completely disagree with people who say it’s insecure because most attacks are remote and in bulk. Which your password they can login from any browser but are stopped by the SMS code.
For the SMS code they can use mostly automated social engineering to trick a certain percentage into giving it up.
However while A SIM attack may be easy enough for a targeted individual, I don’t think it scales: they have to do work that only helps with one user. It’s too “expensive” compared to automated social engineering against a million vulnerable users
The most common way is basically calling up your phone company and pretending to be you saying you needed to switch phones
But also beyond just that the networks that route calls and texts globally are not very secure… and it’s not as hard as it should be to get access to it.
It’s all just a big “in theory” really. It’s “insecure” in that if someone knows the telco you are with, and the telco that you’re with doesn’t follow procedures to verify that a caller is who they say they are, you could have someone else steal your phone number by getting a replacement sim card sent to them.
In reality it’s nothing to worry about. Like…at all. Every telco I’ve been with sends you a sms to confirm that you requested a new SIM card, and that’s after they’ve confirmed that you are who you say you are via sending you a code on your phone number or email.
To make it worse, SMS is incredibly insecure. Nothing should send you codes via SMS
Theoretically sure, but the chances of anyone getting their SMS hacked and their 2FA code being used to compromise their account is so infinitesimally small that it’s not even worth mentioning.
its also very inconvenient if you are outside of the country and dont want to pay for roaming. Cellphone providers should offer a way to forward sms messages to an email address, their own webpage or an app.
It is coding for the lowest common denominator of user – those who use the same easily-guessable password for everything. Making them click a link to login is honestly better security.
Of course there should be an option for those of us who have a TOTP app and use a password manager.
Can’t brain today, I have the dumb. What’s TOTP, other than that BBC show?
Time based one time passwords. Those (usually) six digit codes which get replaced every 30 seconds or so. During setup you copied the secret to your device (usually smartphone) and now your device and the server you authenticate at can calculate the same secret code every thirty seconds.
Which reminds me: I just got a new phone and totally forgot about Authenticator apps
I was able to recover one but the other is lost and I still need to get those accounts reset
Adding a shameless plug here: Aegis is available on f-droid and allows you to backup your 2FA secrets on your own server (e.g. own nextcloud) in case you don’t trust the default Google authenticator.
I’m due to rebuild my lab this winter so I’ll make sure to take a look
I’m due to rebuild my lab this winter…
Famous last words before emerging 3 years later.
Accompanied by “I can stop any time I want” when buying another domain.
Personally I’m frustrated with always having to give a working phone number to accounts.
I have no idea if I’ve been at all successful in poisoning my data but all my accounts use unique generated emails in addition to generated passwords and fake profile info. It’s just habit now.
However all too often the one piece of real data I have to give is my phone number, and that would be really useful to cross-link all my accounts for data brokers building a dossier on me.
I have hundreds of fake emails but can create at most a couple phone numbers
Same situation for me. I’m hoping a forward thinking cell provider can develop something to combat this. I guess dummy phone numbers wouldn’t work, at least not in large cities since they already run out of phone numbers and have to invent new area codes. Maybe provide customers with unlimited extensions?
It can’t be that simple since you’d always be identifiable to anyone who knows the trick
I wonder if there’s a technical limitation to the number of extensions. If a number can have six or seven digit extensions perhaps someone could allocate those randomly, with forwarding to your real number
I’m paranoid so I view passkeys and similar streamlined login mechanisms as a way to make it easy for police to access your entire digital life once they unlock your phone.
This is why manufacturers started pushing biometric unlocking so hard. Once someone has access to your person and phone they no longer need PINs or passwords to gain access to everything.
Most phone OSes now have a “lockdown mode” which temporarily disables biometric authentication until you use a PIN to unlock it.
For me, the lockdown mode is on the shutdown menu that you get of you hold the lock button for a few seconds. (I have stock android on Pixel 7). Alyernatively, I could hold the power button surreptitiously until the phone reboots, requiring my PIN to unlock it.
If a service were going to passkeys for sake of law enforcement or works be so much easier for them to just comply with bypassing auth to access the user data altogether. Passkey implementations originally only supported very credible offline mechanisms and only relaxed those requirements when it became clear the vast majority of people couldn’t handle replacing their devices with passkeys.
For screen lock for the common person it was either that or nothing at all. So demanding a PIN only worked because most of the time the user didn’t have to deal with it owing to touching a fingerprint or face unlock.
People hate passwords and mitigate that aggravation by giving random Internet forum the same password as their bank account. I wouldn’t want to take user passwords because I know I have a much higher risk of a compromise somehow leading to compromise of actually important accounts elsewhere.
Outsourcing the securiry risk to a third-party
Yup. “That’s not on me! Your email was compromised! That’s between your email provider and you!”
Because people don’t realize how ridiculously insecure SMS and (usually unencrypted) email are.
It’s just kids who never had a mentor.
They’re offloading authentication to your email provider. It’s basically quick and cheap oauth. I think it’s because they’re trying to avoid being a vector for a data breach.
The irony being that putting all of a user’s eggs in one basket makes things far riskier for the user, and not less.
Smearing authentication credential data out across the entire Internet makes a sloppy user safer because the inevitable breeches that come with being sloppy are contained, but it increases the demands on a safe user while also increasing their attack surface. Though such a user does typically have a single point of failure in the form of their own sloppy password management.
deleted by creator
My previous bank does this sends an SMS. Extremely insecure & also pointless if a would be thief has my phone (if im stupid enough to use no/easily guessable PIN) or has compromised it.
Is there not an argument that password managers have been around long enough now that anyone reusing logins & easily guessable passwords responsible for their own stupidity? We all know not to leave our doors & windows wide open when we go on vacation.
banks have the most obnoxious, yet the stupidest security measures.
Banks are the web sites most likely to reject a generated password from my password generator
It’s been a few years, I dont know if they ever fixed it…
However, at least as of 2022, Wells Fargo (the 4th largest bank), had case insensitive passwords.
If you made your password
hUnTer2, you could also log in withHUNTER2,hunter2,HUntEr2, etc.All I can say is: Take my money!
How stupid of WF.
you underestimate how bad a lot of people are at using technology. something like banking can be a necessity and must be accessible to all. many banks should encourage more secure MFA but i understand why they can’t require it.
sometimes people just need to learn
we don’t always need a race to the dumbest bottom
accessibility must not mean sacrificing security
you’re asking the refugee who just immigrated, is learning the local language, and may not have had as much exposure to web banking systems and MFA and many aspects of cybersecurity to figure out how to set this up and manage it well without accidentally losing access.
you’re asking the old retiree who has no family left to help them and doesn’t understand technology very well but understands how to open the shortcut to the banks website and check their texts to suddenly understand a much more complex system than they’re used to.
you’re asking the young adult whose school didn’t teach them about technology and they were too poor to have much of their own to instantly learn about even more tools and apps on top of trying to adjust to using technology in general.
I’m not saying that improving security or moving towards a more secure baseline is bad, but for some critical public services security absolutely does not always trump accessibility. cybersecurity and technology education is more necessary at all levels and must equitably taught, but that will take time, resources, and effort. there are ways to improve security without compromising accessibility.
gg ez ease of use feature, which is hilarious because that’s exactly where smishing attacks come in. People are actually more willing to give out the OTP than their actual password, so it definitely less secure.
I think this started out as a decently good idea, like sign in with a device type of feature (think QR code from an authenticated device), but then along the way someone just went “screw it” and changed it to an OTP.
Even in 2025 password managers are rare, people still reuse the same 8 character password everywhere, and people fall for low effort scams. So someone thought “if they’re gonna be insecure anyway, lets just make it so they never have to use a password and sync it to their phone or email”.
I hate the SMS ones, because I don’t have a good phone signal in my home, so I have to ruin around trying to get a couple of bars so I can get the effing code. My banking app just uses a fingerprint.
Check out if your router and provider supports SIP. It allows sms and calls over your wifi connection
No, is the answer. Moving to another ISP when my plan runs out. I’m paying extra for a VoIP line and want to move to WiFi calling.
i have no proof, but im semi sure that this way you cannot sign up with a temp mail or temp sms, so you are kinda forced to use your real data, which means the site is selling your data
You can generate one-time-use email addresses by using the little-know mailbox field of the email address format:
kepix+you_can_write_anything_here_and_it_will_reach_your_inbox@gmail.comObviously this will not fool a human being into thinking you are a different person, but I have never encountered authentication code that treats two mailboxes at the same address to be the same person. This is useful for identifying the source of data breaches, when you start getting phishing attacks at your “[email protected]” address, and makes it trivial to train your spam/important filters.
Just use temporary email addresses. Fastmail generates them for free with a button click, and doesnt share your real email.
It’s an immediate red flag for me.
Because passwordless authentication is awesome and needs to be the standard. It’s basically just skipping the password and going straight to 2FA, which is the main security behind any account that you’ve got 2FA on.
If you skip the password then you’re back down to just 1FA, it just happens to be the factor that used to be second.
Yeh but with 2FA the password is essentially irrelevant because no one other than you can get in even if they have your password, so why not just skip it?
What downsides are there to passwordless authentication in your mind?
I’m not defending passwords specifically. You could do better 2FA with email + biometrics, although of course device authentication is only as secure as the device itself—but that’s entirely beside the point, which is that there must be two factors if you’re going to call something two factor authentication.
Passwordless isn’t 2FA……it’s passwordless. I’m not calling it 2FA.
I see that the comment I initially replied to has been edited, but it still reads as though the second factor of 2FA is itself 2FA:
Because passwordless authentication is awesome and needs to be the standard. It’s basically just skipping the password and going straight to 2FA, which is the main security behind any account that you’ve got 2FA on.
2FA stands for two-factor authentication. The typical case you’re describing:
Factor 1: password Factor 2: device check, usually
That second step of device verification itself isn’t 2FA, it’s only the second factor of that particular 2FA, and the reason your account is more secure behind it isn’t because it’s a device check but because it’s a second factor. There’s not really a “main” security check in 2FA because having two is the whole point.
I do have thoughts about passwordless as a standalone security measure, but that’s not at all what I’m addressing here. I will add, however, that since passwordless can only ever be as strong as the security on your email account…it might seem like enough if your email is protected by 2FA—but not if you mistakenly leave your email logged in on a device someone else has access to, which may sound stupid but it definitely happens.
I see that the comment I initially replied to has been edited, but it still reads as though the second factor of 2FA is itself 2FA:
Sorry but that’s just you misinterpreting it. I was explaining what passwordless authentication is like compared to the current password+2FA system, in which passwordless is basically just going straight to the 2FA, not that passwordless is 2FA. You don’t need to explain 2FA to me, I very much know what it is lol
it might seem like enough if your email is protected by 2FA—but not if you mistakenly leave your email logged in on a device someone else has access to, which may sound stupid but it definitely happens.
This is the worst argument that people keep coming back to. If you have left your email logged in on a device that someone else has access to, you’ve been compromised. You don’t use that as an argument against other services.
Also passwordless isn’t only authenticated by email. It’s usually done via an authenticator app.
deleted by creator
Because the password still needs to be correct. What if the thief has your phone but no password
If a thief already has your phone unlocked then nothing else matters, you’re fucked and all your accounts are compromised.
There’s lots of factors for everything isn’t there. If a thief has your phone unlocked then yes you’re pretty much knackered
There’s no other factors when a thief already has your phone unlocked, which is why it’s a bad point to use against passworldess authentication in this argument.
Password reset?
But they don’t have access to your email in this instance.
If the thief has your email and password and phone then you’re SOL
If they don’t have email access, why is a passwordless magic link sent to an email bad then?
The tech “enthusiasts” of Lemmy are really showing their arses in here lol. They have a “I took 2 semesters of computer science so I’m somewhat of an expert” level of understanding and mentality.
There’s a reason most big tech companies are starting to move to passwordless logins. If 2FA is the ultimate protection about unauthorised access, the password is ultimately irrelevant - and given all we know about password reuse and data breaches, getting rid of them is a good thing.
If they’ve got your phone with your 2FA they’ve also got your email on your phone lol
Technically the truth, but an argument can be made that 2FA was mostly more secure by virtue of how bad password security is, and selling a switch to passkey as a convenience is a big security win.
Also with passkey, you’ll be commonly be forced to do some sort of device unlock making it generally the “thing you have” require either “thing you are” or “thing you know” so it becomes effectively 2fa.
Yeah, password on its own is weak. Any factor + password will always be a lot more secure than password alone OR the other factor alone, but pairing stronger factors of course results in stronger pairings.
Passkey is a device check (the key lives on your device and nowhere else), so it relies on your device security, even if it’s just a PIN…and there has to be a backup option in case you lose access to that device, in which case the account only ends up as secure as that authentication method…which hopefully isn’t password alone.
Though passkeys are now commonly shared across devices. That was one of the changes they made. For example, chrome will gladly do all the passkey management in the Google password manager. Under Linux at least there’s isn’t even a whiff of trying to integrate with a hardware security device. First pass they demanded either a USB device or Bluetooth connection to a phone doing it credibly, or windows hello under windows, but now they decided to open it up.
Which services? I haven’t stumbled upon a single one
Can’t be liable for theft if there were no locks?
well, in case of sending an email with a temporary access code it’s not different than using the “forgot password” link
