If the registration email is compromised, the attacker can reset the password. So the password doesn’t offer any additional security, in actual practice, over just testing control of the registration email address. If anything, passwords are less secure.
this post was submitted on 31 Oct 2025
141 points (99.3% liked)
No Stupid Questions
44222 readers
532 users here now
No such thing. Ask away!
!nostupidquestions is a community dedicated to being helpful and answering each others' questions on various topics.
The rules for posting and commenting, besides the rules defined here for lemmy.world, are as follows:
Rules (interactive)
Rule 1- All posts must be legitimate questions. All post titles must include a question.
All posts must be legitimate questions, and all post titles must include a question. Questions that are joke or trolling questions, memes, song lyrics as title, etc. are not allowed here. See Rule 6 for all exceptions.
Rule 2- Your question subject cannot be illegal or NSFW material.
Your question subject cannot be illegal or NSFW material. You will be warned first, banned second.
Rule 3- Do not seek mental, medical and professional help here.
Do not seek mental, medical and professional help here. Breaking this rule will not get you or your post removed, but it will put you at risk, and possibly in danger.
Rule 4- No self promotion or upvote-farming of any kind.
That's it.
Rule 5- No baiting or sealioning or promoting an agenda.
Questions which, instead of being of an innocuous nature, are specifically intended (based on reports and in the opinion of our crack moderation team) to bait users into ideological wars on charged political topics will be removed and the authors warned - or banned - depending on severity.
Rule 6- Regarding META posts and joke questions.
Provided it is about the community itself, you may post non-question posts using the [META] tag on your post title.
On fridays, you are allowed to post meme and troll questions, on the condition that it's in text format only, and conforms with our other rules. These posts MUST include the [NSQ Friday] tag in their title.
If you post a serious question on friday and are looking only for legitimate answers, then please include the [Serious] tag on your post. Irrelevant replies will then be removed by moderators.
Rule 7- You can't intentionally annoy, mock, or harass other members.
If you intentionally annoy, mock, harass, or discriminate against any individual member, you will be removed.
Likewise, if you are a member, sympathiser or a resemblant of a movement that is known to largely hate, mock, discriminate against, and/or want to take lives of a group of people, and you were provably vocal about your hate, then you will be banned on sight.
Rule 8- All comments should try to stay relevant to their parent content.
Rule 9- Reposts from other platforms are not allowed.
Let everyone have their own content.
Rule 10- Majority of bots aren't allowed to participate here. This includes using AI responses and summaries.
Credits
Our breathtaking icon was bestowed upon us by @Cevilia!
The greatest banner of all time: by @TheOneWithTheHair!
founded 2 years ago
MODERATORS
Side rant:
To make it worse, SMS is incredibly insecure. Nothing should send you codes via SMS, and if you have the option to use an authenticator app, do that. It's atrocious so many banks only have SMS as an option.
The really dumb part is, the SMS codes are literally the same authenticator algorithm, but running on their servers and sent to you via an insecure medium.
And one little lapse in not paying a cell phone bill can cause you to lose your phone number, which then means you can no longer authenticate.
this is why I don't like it and why I often advocate that countries should provide a secure email that you can come to an office in person if you can't get to it. People get mad as if Im suggesting it should be the only email they have but what I really want is a guaranteed thing that is made as secure as possible and allows for real in person support to make sure you can get access or stop someone that somehow got access.
This shit drives me nuts. I've put in a lot of effort to secure my accounts but a number of them require SMS without any opt out. We have known about the risks of SMS plenty long enough at this point.
its also very inconvenient if you are outside of the country and dont want to pay for roaming. Cellphone providers should offer a way to forward sms messages to an email address, their own webpage or an app.
I never understood why SMS is insecure, are you saying it's easy to intercept someone's number? How would that even work without the SIM?
Getting a replacement SIM from the phone company is often shockingly easy, just a tiny bit of social engineering. And then you have access to the number and everything that 2FA "protects"
It is but only if you are targeted. I completely disagree with people who say it’s insecure because most attacks are remote and in bulk. Which your password they can login from any browser but are stopped by the SMS code.
For the SMS code they can use mostly automated social engineering to trick a certain percentage into giving it up.
However while A SIM attack may be easy enough for a targeted individual, I don’t think it scales: they have to do work that only helps with one user. It’s too “expensive” compared to automated social engineering against a million vulnerable users
load more comments
(2 replies)
load more comments
(1 replies)
Personally I’m frustrated with always having to give a working phone number to accounts.
I have no idea if I’ve been at all successful in poisoning my data but all my accounts use unique generated emails in addition to generated passwords and fake profile info. It’s just habit now.
However all too often the one piece of real data I have to give is my phone number, and that would be really useful to cross-link all my accounts for data brokers building a dossier on me.
I have hundreds of fake emails but can create at most a couple phone numbers
Same situation for me. I'm hoping a forward thinking cell provider can develop something to combat this. I guess dummy phone numbers wouldn't work, at least not in large cities since they already run out of phone numbers and have to invent new area codes. Maybe provide customers with unlimited extensions?
It can’t be that simple since you’d always be identifiable to anyone who knows the trick
I wonder if there’s a technical limitation to the number of extensions. If a number can have six or seven digit extensions perhaps someone could allocate those randomly, with forwarding to your real number
They're offloading authentication to your email provider. It's basically quick and cheap oauth. I think it's because they're trying to avoid being a vector for a data breach.
The irony being that putting all of a user’s eggs in one basket makes things far riskier for the user, and not less.
Smearing authentication credential data out across the entire Internet makes a sloppy user safer because the inevitable breeches that come with being sloppy are contained, but it increases the demands on a safe user while also increasing their attack surface. Though such a user does typically have a single point of failure in the form of their own sloppy password management.
It is coding for the lowest common denominator of user -- those who use the same easily-guessable password for everything. Making them click a link to login is honestly better security.
Of course there should be an option for those of us who have a TOTP app and use a password manager.
load more comments
(7 replies)
I'm paranoid so I view passkeys and similar streamlined login mechanisms as a way to make it easy for police to access your entire digital life once they unlock your phone.
This is why manufacturers started pushing biometric unlocking so hard. Once someone has access to your person and phone they no longer need PINs or passwords to gain access to everything.
Most phone OSes now have a "lockdown mode" which temporarily disables biometric authentication until you use a PIN to unlock it.
For me, the lockdown mode is on the shutdown menu that you get of you hold the lock button for a few seconds. (I have stock android on Pixel 7). Alyernatively, I could hold the power button surreptitiously until the phone reboots, requiring my PIN to unlock it.
If a service were going to passkeys for sake of law enforcement or works be so much easier for them to just comply with bypassing auth to access the user data altogether. Passkey implementations originally only supported very credible offline mechanisms and only relaxed those requirements when it became clear the vast majority of people couldn't handle replacing their devices with passkeys.
For screen lock for the common person it was either that or nothing at all. So demanding a PIN only worked because most of the time the user didn't have to deal with it owing to touching a fingerprint or face unlock.
People hate passwords and mitigate that aggravation by giving random Internet forum the same password as their bank account. I wouldn't want to take user passwords because I know I have a much higher risk of a compromise somehow leading to compromise of actually important accounts elsewhere.
i have no proof, but im semi sure that this way you cannot sign up with a temp mail or temp sms, so you are kinda forced to use your real data, which means the site is selling your data
You can generate one-time-use email addresses by using the little-know mailbox field of the email address format:
kepix+you_can_write_anything_here_and_it_will_reach_your_inbox@gmail.com
Obviously this will not fool a human being into thinking you are a different person, but I have never encountered authentication code that treats two mailboxes at the same address to be the same person. This is useful for identifying the source of data breaches, when you start getting phishing attacks at your "kepix+reddit.com@gmail.com" address, and makes it trivial to train your spam/important filters.
load more comments
(1 replies)
gg ez ease of use feature, which is hilarious because that's exactly where smishing attacks come in. People are actually more willing to give out the OTP than their actual password, so it definitely less secure.
I think this started out as a decently good idea, like sign in with a device type of feature (think QR code from an authenticated device), but then along the way someone just went "screw it" and changed it to an OTP.
Even in 2025 password managers are rare, people still reuse the same 8 character password everywhere, and people fall for low effort scams. So someone thought "if they're gonna be insecure anyway, lets just make it so they never have to use a password and sync it to their phone or email".
Because people don't realize how ridiculously insecure SMS and (usually unencrypted) email are.
It's just kids who never had a mentor.
My previous bank does this sends an SMS. Extremely insecure & also pointless if a would be thief has my phone (if im stupid enough to use no/easily guessable PIN) or has compromised it.
Is there not an argument that password managers have been around long enough now that anyone reusing logins & easily guessable passwords responsible for their own stupidity? We all know not to leave our doors & windows wide open when we go on vacation.
banks have the most obnoxious, yet the stupidest security measures.
Banks are the web sites most likely to reject a generated password from my password generator
It's been a few years, I dont know if they ever fixed it...
However, at least as of 2022, Wells Fargo (the 4th largest bank), had case insensitive passwords.
If you made your password hUnTer2, you could also log in with HUNTER2, hunter2, HUntEr2, etc.
load more comments
(1 replies)
load more comments
(3 replies)
I hate the SMS ones, because I don't have a good phone signal in my home, so I have to ruin around trying to get a couple of bars so I can get the effing code. My banking app just uses a fingerprint.
Check out if your router and provider supports SIP. It allows sms and calls over your wifi connection
No, is the answer. Moving to another ISP when my plan runs out. I'm paying extra for a VoIP line and want to move to WiFi calling.
From my experience things like this are not important services. they are things where I keep the password in an online password service which I won't do for anything important.
I think to reduce friction for gaining new users.
view more: next ›