4 ms·
You misread the short article. It's about email as single factor auth, which has become very trendy of late. You just enter your email address, no password, an
by donatj 1y ago
You misread the short article.
It's about email as single factor auth, which has become very trendy of late. You just enter your email address, no password, and the email you a code. Access to your email is the only authentication.
- pandorobo 1y agoThe first bullet point mentions phone number. - Enter an email address or phone number Thats not just email, that's also SMS.
- eddythompson80 1y agoEmail OR SMS is still one factor. Its not multiple factors. How are you not getting that? Do you know what MFA means?
- max__dev 1y agoEven if it was Email OR password, that would still be one factor due to the OR. I do not think they are discussing in good faith.
- pandorobo 1y agoClearly I didn't misread that. It's literally the very first bullet point?
- deleted 1y ago[deleted]
- Thorrez 1y agoThe first bullet point is "Enter an email address or phone number". That's not MFA. MFA stands for multi-factor authentication. If the authentication only requires a code sent to an email OR phone number, that's just a single factor.
- Ferret7446 1y ago> It's about email as single factor auth, which has become very trendy of late I must be in the wrong bubble, I have not encountered any site that does this since the 2000s. It was a minor trend around then IIRC.
- wvenable 1y agoSpotify just started doing this. I even have a password saved in my password manager but instead of asking me they just sent an email with a code.
- eddythompson80 1y agoAnthropic is the main one. Its pushing a lot of others to do the same. I literally was arguing against that 2 weeks ago and the person who was pushing it said "Claude does that. Its really slick, no password to remember". Patreon can do that too, depending on how you sign up.
- moi2388 1y agoIt’s not slick at all. Passwords and MFA autofill, their image codes don’t, so I have to close the browser, go to email, copy code, delete email, go to browser, paste code just to login. The entire email login flow is completely retarded. It’s not even secure.
- vachina 1y agoIt’s not just slick, it is “secure” on the get go by thwarting any password stuffing attempts (if your email is not pwned already)
- const_cast 1y agoA lot of services just do this de-facto, where you only need an email code to reset the password. Which is equivalent to single auth with email. Email link to reset is better, email link + another auth (usually sms) is even better.
- eddythompson80 1y ago
- M95D 1y agoBut then, email always was the only authentication. On any site, click "forgot password" and promptly they send you a reset password link. Very few sites have a challenge question.
- ClikeX 1y agoCould be worse, I still sometimes get my password emailed in plain text by companies when I do that.