3 ms·
Passwords are an antipattern. Password managers are just a crutch to make it less painful. Password recovery is often done through the phone via SMS (health c
by bb88 4y ago
Passwords are an antipattern. Password managers are just a crutch to make it less painful.
Password recovery is often done through the phone via SMS (health care/banking) when a 2FA hardware key would be safer. And since you're implementing 2FA, just remove the password, and ask the user to use the 2FA key.
- smeej 4y agoI think my favorite example of using SMS in the least sane way possible is PayPal. I have a hardware key AND an authenticator app active for the account, but they STILL won't let me send transactions without entering a code sent to my phone number. And actually, not even then, because even though I receive the code fine, they say they can't authenticate me and don't give me a chance to enter it. Yes, it's a VOIP number, but it's been the same VOIP number for the 10 years I've had the account. It's not like it's new.
- bb88 4y agoI needed to recover my user account / password through Voya recently for a corporate 401k. They needed to send me 3(!) SMS messages in the process. One to get the username (with a valid email address). One more to request to change the password. And one more to actually change the password.