Programmer Humor

Ah but you see it's one factor of authentication that also conveniently loops in whichever email provider is spying on you

But if they don't get an active email and/or phone number.

How can they then turn around and sell that to info brokers and spammers.

Just let me use passkeys at this point. The way that people typically use passwords is less secure anyway, why not just make it as simple as possible?

There are a few reasons for this.

1. Conversion rates are higher and the majority tend to prefer these over passwords
2. When you have to reset a password, you typically have to send an email anyway.
3. It's technically safer because they are short lived tokens and if someone's password gets compromised, their token cannot.

It's not a perfect system by any means, but it's better than the shit implementation of passkeys and it's generally better than passwords for most users.

I prefer passwords over links and codes, but I get it.

My email uses greylisting which is where the first email received from a server gets a "busy" response - the idea being that spammers just fire and forget whereas real mailers will retry.

Unfortunately, some senders take so long to resend that it's timed out. The second time will work though. Unless they have multiple servers. Some have so many servers that you have to do this a multitude of times until you lose the will to login or forget what you were going to do anyway.

It feels like the factors of authentication discussion misses one important aspect: can the factor be replayed. Passwords can be replayed indefinitely, while the email links you get or the OTP token only work for a short period of time.

I remember it from the bad days when I used LastPass. Suddenly I got a notification that the place had been compromised and I had to suddenly change hundreds of passwords. 90% of them were for sites that didn't even exist any longer, but sifting through the long, long list to go change passwords was more work than I wanted to do.

Don't have to do that if I need to use a one-time token via Aegis or email! I do agree, though, that for low risk sites, username/password is totally fine.

I can imagine that the sites want to validate that you still have access to the email associated with the account, and asking people to check their settings is annoying, and they know no one will do it. I can also imagine that sites want to know as much about you as possible, don't want you to be using burner email addresses, and are probably selling the fact that your email address can still receive email to marketing firms who compile that info.

Hearing this in Spongebob's voice is amazing!

The amount of security threat encouragement in these comments is impressive.

Passwords are quite insecure and people write them down on shit and forget them, I vastly prefer it too, but they're going to die out, probably rather soon, so be prepared.

I weirdly don't mind the email method. I don't like copy pasting my passwords because I feel it's less secure than typing it out.

Now I wouldn't mind if it was an option.