4 ms·
The idea that someone is going to invent and remember a password for every dumb service is not real, and when you build another password based authentication sy
by thatjoeoverthr 2y ago
The idea that someone is going to invent and remember a password for every dumb service is not real, and when you build another password based authentication system, you are doing a kind of LARP.
Passwords are used in one of two ways:
1. a password manager guarded by a single actual password
2. the same password repeated between services
Practically every service offers e-mail recovery, so, in practice, your e-mail is your authentication.
Personal e-mail accounts are rarely replaced, not shared, and aren't reused. You've probably had your personal e-mail longer than your phone number. I've had at least five phone numbers in the life time of my current e-mail address. Other people now have those numbers.
- bombcar 2y agoApple has made the incredibly annoying “you can’t just enter your 1Password/keychain password, you have to dick around with email” process much nicer; at least when it can recognize the email/text and enter the code for you.
- bmitc 2y agoApple is the worst about this. The only option is that they send a message to an Apple device. I only have an iPad and not an iPhone or Macbook, so I often simply cannot log into my Apple account because they refuse to do anything else besides send it to an Apple device.
- 4ad 2y agoNot true, you can use FIDO2 keys. You can even use SMS (but you shouldn't).
- bmitc 2y agoYes, it is true. There are indeed cases where you are not presented with SMS options. And I'm not going to purchase and carry around a hardware key just for the privilege of periodically logging into my Apple accounts. Maybe Apple shouldn't force you to own an Apple device to login to your accounts? They've been sued about this before and lost. If Microsoft did this, people would lose their minds.
- paulryanrogers 2y agoThere are also derived passwords, which are kind of a hybrid. Either as a pattern the human remembers or a manager that does the calculation per domain. I'd also add that forgot password features at least notify the address owner of every attempt. Password based logins don't always email on every login from a new location.