Why have so many services started using single-factor passwordless authentication in the last little while?

Submitted ⁨⁨1⁩ ⁨day⁩ ago⁩ by ⁨Interstellar_1@lemmy.blahaj.zone⁩ to ⁨nostupidquestions@lemmy.world⁩

Either by sending a code to SMS or Email, you are able to sign into your account without ever needing to or being able to add a password. Why has this become a thing recently?

source

Comments

Sort:hotnew top

ilinamorato@lemmy.world ⁨1⁩ ⁨hour⁩ ago
They’re offloading authentication to your email provider. It’s basically quick and cheap oauth. I think it’s because they’re trying to avoid being a vector for a data breach.

source
LuigiMaoFrance@lemmy.ml ⁨9⁩ ⁨hours⁩ ago
I’m paranoid so I view passkeys and similar streamlined login mechanisms as a way to make it easy for police to access your entire digital life once they unlock your phone. This is why manufacturers started pushing biometric unlocking so hard. Once someone has access to your person and phone they no longer need PINs or passwords to gain access to everything.

source
- ilinamorato@lemmy.world ⁨1⁩ ⁨hour⁩ ago
  Most phone OSes now have a “lockdown mode” which temporarily disables biometric authentication until you use a PIN to unlock it.
  
  source
  - tomcatt360@lemmy.zip ⁨42⁩ ⁨minutes⁩ ago
    For me, the lockdown mode is on the shutdown menu that you get of you hold the lock button for a few seconds. (I have stock android on Pixel 7). Alyernatively, I could hold the power button surreptitiously until the phone reboots, requiring my PIN to unlock it.
    
    source
AA5B@lemmy.world ⁨13⁩ ⁨hours⁩ ago
Personally I’m frustrated with always having to give a working phone number to accounts.

I have no idea if I’ve been at all successful in poisoning my data but all my accounts use unique generated emails in addition to generated passwords and fake profile info. It’s just habit now.

However all too often the one piece of real data I have to give is my phone number, and that would be really useful to cross-link all my accounts for data brokers building a dossier on me.

I have hundreds of fake emails but can create at most a couple phone numbers

source
- tang999@lemmy.world ⁨1⁩ ⁨hour⁩ ago
  Same situation for me. I’m hoping a forward thinking cell provider can develop something to combat this. I guess dummy phone numbers wouldn’t work, at least not in large cities since they already run out of phone numbers and have to invent new area codes. Maybe provide customers with unlimited extensions?
  
  source
BombOmOm@lemmy.world ⁨1⁩ ⁨day⁩ ago
Side rant:

To make it worse, SMS is incredibly insecure. Nothing should send you codes via SMS, and if you have the option to use an authenticator app, do that. It’s atrocious so many banks only have SMS as an option.

The really dumb part is, the SMS codes are literally the same authenticator program, but running on their servers and sent do you via an insecure medium.

source
- Ironfist@sh.itjust.works ⁨59⁩ ⁨minutes⁩ ago
  its also very inconvenient if you are outside of the country and dont want to pay for roaming. Cellphone providers should offer a way to forward sms messages to an email address, their own webpage or an app.
  
  source
- 9tr6gyp3@lemmy.world ⁨1⁩ ⁨day⁩ ago
  And one little lapse in not paying a cell phone bill can cause you to lose your phone number, which then means you can no longer authenticate.
  
  source
  - HubertManne@piefed.social ⁨10⁩ ⁨hours⁩ ago
    this is why I don’t like it and why I often advocate that countries should provide a secure email that you can come to an office in person if you can’t get to it. People get mad as if Im suggesting it should be the only email they have but what I really want is a guaranteed thing that is made as secure as possible and allows for real in person support to make sure you can get access or stop someone that somehow got access.
    
    source
- ultranaut@lemmy.world ⁨1⁩ ⁨day⁩ ago
  This shit drives me nuts. I’ve put in a lot of effort to secure my accounts but a number of them require SMS without any opt out. We have known about the risks of SMS plenty long enough at this point.
  
  source
- madcaesar@lemmy.world ⁨1⁩ ⁨day⁩ ago
  I never understood why SMS is insecure, are you saying it’s easy to intercept someone’s number? How would that even work without the SIM?
  
  source
  - AA5B@lemmy.world ⁨14⁩ ⁨hours⁩ ago
    It is but only if you are targeted. I completely disagree with people who say it’s insecure because most attacks are remote and in bulk. Which your password they can login from any browser but are stopped by the SMS code.
    
    For the SMS code they can use mostly automated social engineering to trick a certain percentage into giving it up.
    
    However while A SIM attack may be easy enough for a targeted individual, I don’t think it scales: they have to do work that only helps with one user. It’s too “expensive” compared to automated social engineering against a million vulnerable users
    
    source
  - BombOmOm@lemmy.world ⁨1⁩ ⁨day⁩ ago
    Veritasium did a great video on it. Anything I can say about it will be 10x worse than that video.
    
    source
  - Tanoh@lemmy.world ⁨1⁩ ⁨day⁩ ago
    Getting a replacement SIM from the phone company is often shockingly easy, just a tiny bit of social engineering. And then you have access to the number and everything that 2FA “protects”
    
    source
  - bdonvr@thelemmy.club ⁨1⁩ ⁨day⁩ ago
    The most common way is basically calling up your phone company and pretending to be you saying you needed to switch phones
    
    But also beyond just that the networks that route calls and texts globally are not very secure… and it’s not as hard as it should be to get access to it.
    
    source
  - FreedomAdvocate@lemmy.net.au ⁨1⁩ ⁨day⁩ ago
    It’s all just a big “in theory” really. It’s “insecure” in that if someone knows the telco you are with, and the telco that you’re with doesn’t follow procedures to verify that a caller is who they say they are, you could have someone else steal your phone number by getting a replacement sim card sent to them.
    
    In reality it’s nothing to worry about. Like…at all. Every telco I’ve been with sends you a sms to confirm that you requested a new SIM card, and that’s after they’ve confirmed that you are who you say you are via sending you a code on your phone number or email.
    
    source
- FreedomAdvocate@lemmy.net.au ⁨1⁩ ⁨day⁩ ago
  
  To make it worse, SMS is incredibly insecure. Nothing should send you codes via SMS
  
  Theoretically sure, but the chances of anyone getting their SMS hacked and their 2FA code being used to compromise their account is so infinitesimally small that it’s not even worth mentioning.
  
  source
stinerman@midwest.social ⁨1⁩ ⁨day⁩ ago
It is coding for the lowest common denominator of user – those who use the same easily-guessable password for everything. Making them click a link to login is honestly better security.

Of course there should be an option for those of us who have a TOTP app and use a password manager.

source
- neidu3@sh.itjust.works ⁨1⁩ ⁨day⁩ ago
  Can’t brain today, I have the dumb. What’s TOTP, other than that BBC show?
  
  source
  - dbx12@programming.dev ⁨1⁩ ⁨day⁩ ago
    Time based one time passwords. Those (usually) six digit codes which get replaced every 30 seconds or so. During setup you copied the secret to your device (usually smartphone) and now your device and the server you authenticate at can calculate the same secret code every thirty seconds.
    
    source
    -> View More Comments
HubertManne@piefed.social ⁨9⁩ ⁨hours⁩ ago
From my experience things like this are not important services. they are things where I keep the password in an online password service which I won’t do for anything important.

source
mlg@lemmy.world ⁨21⁩ ⁨hours⁩ ago
gg ez ease of use feature, which is hilarious because that’s exactly where smishing attacks come in. People are actually more willing to give out the OTP than their actual password, so it definitely less secure.

I think this started out as a decently good idea, like sign in with a device type of feature (think QR code from an authenticated device), but then along the way someone just went “screw it” and changed it to an OTP.

Even in 2025 password managers are rare, people still reuse the same 8 character password everywhere, and people fall for low effort scams. So someone thought “if they’re gonna be insecure anyway, lets just make it so they never have to use a password and sync it to their phone or email”.

source
kambusha@sh.itjust.works ⁨1⁩ ⁨day⁩ ago
Outsourcing the securiry risk to a third-party

source
- kn33@lemmy.world ⁨1⁩ ⁨day⁩ ago
  Yup. “That’s not on me! Your email was compromised! That’s between your email provider and you!”
  
  source
Saltarello@lemmy.world ⁨23⁩ ⁨hours⁩ ago
My previous bank does this sends an SMS. Extremely insecure & also just means a would be thief has my phone. I’ve never understood it.

Is there not an argument that password managers have been around long enough now that anyone reusing logins & easily guessable passwords responsible for their own stupidity? We all know not to leave our doors & windows wide open when we go on vacation.

source
- vrighter@discuss.tchncs.de ⁨22⁩ ⁨hours⁩ ago
  banks have the most obnoxious, yet the stupidest security measures.
  
  source
  - AA5B@lemmy.world ⁨14⁩ ⁨hours⁩ ago
    Banks are the web sites most likely to reject a generated password from my password generator
    
    source
    -> View More Comments
- erev@lemmy.world ⁨22⁩ ⁨hours⁩ ago
  you underestimate how bad a lot of people are at using technology. something like banking can be a necessity and must be accessible to all. many banks should encourage more secure MFA but i understand why they can’t require it.
  
  source
  - birdwing@lemmy.blahaj.zone ⁨6⁩ ⁨hours⁩ ago
    sometimes people just need to learn
    
    source
    -> View More Comments
corsicanguppy@lemmy.ca ⁨1⁩ ⁨day⁩ ago
Because people don’t realize how ridiculously insecure SMS and (usually unencrypted) email are.

It’s just kids who never had a mentor.

source
MrsDoyle@sh.itjust.works ⁨22⁩ ⁨hours⁩ ago
I hate the SMS ones, because I don’t have a good phone signal in my home, so I have to ruin around trying to get a couple of bars so I can get the effing code. My banking app just uses a fingerprint.

source
- Funky_Beak@lemmy.sdf.org ⁨2⁩ ⁨hours⁩ ago
  Check out if your router and provider supports SIP. It allows sms and calls over your wifi connection
  
  source
HeerlijkeDrop@thebrainbin.org ⁨19⁩ ⁨hours⁩ ago
Which services? I haven't stumbled upon a single one

source
FreedomAdvocate@lemmy.net.au ⁨1⁩ ⁨day⁩ ago
Because passwordless authentication is awesome and needs to be the standard.

source
- lovely_reader@lemmy.world ⁨1⁩ ⁨day⁩ ago
  If you skip the password then you’re back down to just 1FA, it just happens to be the factor that used to be second.
  
  source
  - FreedomAdvocate@lemmy.net.au ⁨1⁩ ⁨day⁩ ago
    Yeh but with 2FA the password is essentially irrelevant because no one other than you can get in even if they have your password, so why not just skip it?
    
    What downsides are there to passwordless authentication in your mind?
    
    source
    -> View More Comments
wesker@lemmy.sdf.org ⁨1⁩ ⁨day⁩ ago
It’s an immediate red flag for me.

source
CobblerScholar@lemmy.world ⁨1⁩ ⁨day⁩ ago
Can’t be liable for theft if there were no locks?

source
- whyNotSquirrel@sh.itjust.works ⁨1⁩ ⁨day⁩ ago
  well, in case of sending an email with a temporary access code it’s not different than using the “forgot password” link
  
  source
solrize@lemmy.ml ⁨1⁩ ⁨day⁩ ago
Too many big password breaches also occurred to me.

source
- SanctimoniousApe@lemmings.world ⁨1⁩ ⁨day⁩ ago
  But that’s what MFA is there for, although they shouldn’t be using SMS as one of the possible factors - let alone the main one, as seems to be the case.
  
  source
  - Zos_Kia@lemmynsfw.com ⁨19⁩ ⁨hours⁩ ago
    Yeah but your password on my product with MFA is probably used everywhere else without MFA. Most products have a low risk security profile so they don’t want to be the leak for higher risk stuff.
    
    source