Please continue to call common fucking sense idealism. Look how shit any other site besides the 4 (and others like them) I mentioned are with their fancy policies. How can anyone not rage when such stupidity is forced upon us?
How well any policies are actually thought through is another matter.
The problem is not so much that the systems suck, the problem is there's no way for people like me to take on the responsibility and "risk" of just having a simple way to authenticate myself.
For example, in my bank I would opt into having all "suspicious transaction" types of protections turned off, but if I went to my local branch and asked for that, they'd just get confused and think I'm trying to commit fraud.
> it's still better to keep them on board and making money
Maybe better for you, assuming there would be a net loss from turning off the bullshit policy. Definitely not better for customers, as it enables theft, which has the same consequence as forgetting a password.
I have a good backup system so it's not that I use such stuff personally either.
Well yes, I would much prefer that to sending in a picture of my drivers license, only logging in from one IP address, etc. This only really happens with financial sites.
For normal sites, before there were captchas, they required email to sign up, in order to deter spam. Then when they got captchas they still required both, probably because they were thinking "oh yes 2 is better than 1", even though email verification does not deter spam one bit these days. On the other hand, in more recent times you now have all these sites requiring email for recovery. You can see where the dogma came about.
I myself would absolutely never want email recovery, simply because it links the accounts together unless I make a separate email for each, wastes my time (I never lose my passwords, and they are unique for every account), and now the email provider has access to my account.
If this isn't bad enough, facebook, google, and pretty much every mainstream email provider now require a cell phone to sign up, and sends a verification code to your cell (this may be because I use tor).
It only seems to be going downhill. There's no reason not to be infuriated.
On the upside, South Korea recently abolished its law that users should use their id online:
http://online.wsj.com/news/articles/SB1000087239639044408290...
... but it's replaced with SMS:
https://en.wikipedia.org/wiki/Resident_registration_number#O...