One reason more sites are moving to an email or text code is liability. If you don’t have a database of usernames and passwords, it can’t be hacked and stolen.
Which is more secure to log into an online account: simple password, or "secure" code emailed to me?
Well, they still have a highly valuable stealable database of userids, often emails. And a database full of customer details like credit cards, purchase history, physical addresses, interests, etc.
But yeah, the bad guys can’t steal a password from that site if there are no passwords.
One of the reasons a lot of companies use “Shop”, or ask you to pay via PayPal, is so they don’t have a database with a lot of credit card numbers in it.
Not that the emails and addresses and purchase histories aren’t valuable, but they are less worth stealing than either passwords or credit card numbers, with fewer consequences when it happens.
I’ve been assuming this is the reason. Yes, there’s other PII stored, but less is better.
Now if only shop.com and friends did some real-world testing: every one of them has serious usability issues in my experience. Nobody tests nuttin’ no mo’.
Of all of the things that a hacker could steal from a website, the one I care about least is my username and password. Reasons:
- I use a password manager with different random passwords for every website, so my password is only good for that one website. It is useless anywhere else.
- If passwords are ever compromised, the admins of the website itself can immediately make them useless to the attackers by requiring everyone to reset their passwords. I think the SDMB did that once upon a time (twenty years ago or so).
- It should be impossible to steal actual passwords regardless. No website should be storing them in plaintext. They should instead be storing a hash of the passwords (along with salting them) so that they cannot be utilized by an attacker.
So all this effort to get rid of passwords seems misguided for so many reasons—but what is does do is make it much more difficult and sometimes impossible for me to log in to their website for the reasons I outlined in my previous post (i.e. delayed emails, expiring codes, etc.).
Any properly coded website will not store passwords, a one-way hash generated from the password is stored instead. The password cannot be derived from the hash so someone hacking into the backend user database is not able to access the accounts. Granted, having a list of usernames gives hackers a leg up, but not the keys to the kingdom.
There are very strong rules that you have to abide by if you are storing credit card information with audit requirements. It’s no wonder that a lot of organisations would want to offload those requirements on someone else who specialises in dealing with that.
The issue is probably more that so many people insist on using passwords that can be figured out from the hash in a short enough time.
I hate it. I use secure passwords on anything that matters. Slowing down the process just makes me want to use your website less. I wind up permanently signing in on sites I previously wouldn’t have, because it’s a chore.
It’s all the hassle of two-factor without the actual security of two-factor. And, if you’ve seen what I said about Wendy’s (which requires you to open the email on the same device you try to log in with—no typeable code) they love to find ways to make these things worse.
I’m not a huge fan of doing things on my phone but the only time I’d ever possibly want to use a fast food app is when I’m out, meaning I’d want to use my phone for that. I agree that a fast food app doesn’t need the same security as my bank but is it really that big of a deal?
Yes. Because I like to share the app with my roommate so we can both use the benefits. So I would need to have my roommate’s email on my phone. I also tend to use a different email for automated crap so that my main email (the one I would actually use on my phone) can actually be important stuff and not a bunch of useless spam.
I don’t only use apps when I’m out. I order food from home a lot, either to have it ready before I go out, or because roomie is in town with the car. I sometimes buy food for other people. I could in theory also do delivery—something they really seem to want me to do—but that’s a whole other discussion of all the hidden ways they increase the prices to where it’s almost never worth it.
But, regardless, I shouldn’t have to justify my use case. This is pointless reinventing of the wheel. They had to specifically modify their system not to just give a code, like literally every other email verification system. And for what purpose?
Good software design considers edge cases. If you don’t want to do that (and I don’t blame you on a low security app) then you use preexisting solutions that do. I literally cannot see what making people have both the app and that particular email account on the same device accomplishes for anyone.
It’s almost certainly an issue of “well, it’s not inconvenient for me.”
Note any passion in this is toward the developers, not you for asking.
I sympathize with you, but that’s not an edge case. That’s something (sharing accounts among multiple people) that they specifically don’t want to support.
To largely prevent this:
This isn’t hard.
Same as how IIRC Netflix and Comcast xFinity both had to implement technical obstacles to the widespread practice of dozens (hundreds?) of potential customers sharing one account that one somebody was paying for.
Their goal is not to maximise customer convenience. It’s to maximize profitability. Giving out fewer discounts and spiffs, without actually driving too many people into switching to a competitor is the route to that goal. Once we all accept that we’re just sheep to be shorn, not customers to be served, it all makes a LOT more sense.