Yahoo wants to let you forget your Yahoo password

It is less secure than 2 factor auth (since it is 1 factor) but they picked the more secure 1 factor than what is popular right now.

Hopefully they are smart enough to format the txt such that the password doesn't show up in the preview, and if so, in practice, there is almost no downside to this for the vast majority if people (since if the person who now has your phone can log into the phone, the odds are they can already access your email).

Lots of negativity about this here, but let's take a step back and look at something:

When you lose your password to an account, how do you reset it? With your email (in the case of Yahoo, with your backup email). Which, if someone has your unlocked phone, is likely already compromised as part of the unlocked phone.

Sending an OTP via SMS doesn't really open up any new avenues of attack, if they already have your unlocked phone.

Now then, if you're displaying all text messages via lock screen, why have a lock screen at all? Sure, it protects the rest of your phone from intrusion, but it's leaking what should be considered private information to anyone who has it. You're probably also getting email summaries, chat summaries, and upcoming meetings as well.

I was about to post this, thank you for doing so.

Seriously? What could they be thinking? The entire premise of 2-factor - in most cases, something you know and something you have - is that if someone steals/guesses/social hacks my secret, they don't have my keyfob (or phone); if someone steals my keyfob or phone, they don't have my secret knowledge. The probability of losing both is much lower than either.

But using just one factor, and one that goes across insecure networks, and is visible on my phone even on the lock screen? And I cannot use it if I have mobile issues? Really??

This would be a disaster for those living in repressive/dictatorial regimes. Essentially handing them the keys to your e-mail.

If they add a first factor (4 digits PIN code) and this as a second factor, then I think we have a winner. The PIN code will protect you from insecure networks, losing your phone, theft and it's easy to remember.

The PIN code is a weak link, but doesn’t do much without your phone. Your phone is a weak link, but you won’t get the SMS without the PIN code. Chained together they’re almost stupid and fail proof.

For my use case this is less secure because I keep my computers clean of malware, and my hard drives encrypted. I don't reuse passwords and I don't log into my account from devices I don't own. My phone, on the other hand is easy to steal. Anyone who has my sim card can use it to log in. I've also heard it's trivial to use social engineering to redirect a phone number with some carriers. Also, I often don't have signal in buildings, so that makes this option useless.

For other people the SMS option might be better. They let you choose which one you want to use. I guess we'll hear about the results of this experiment later on.

I can imagine the time when my phone receives an email to my Yahoo mail, with my email address shown before my phone being unlocked, and the password to login to my mail box is next to it, in the notification.

Hello Yahoo, First of all please stop asking my phone number to register email.

I forgot my yahoo password long ago, I had used my yahoo account to register a domain name. At the time, I agreed to allow recurring billing (though I don't consciously remember doing this). After a few years of seeing the recurring charge on my bank statement, I called to get a debit card with a new number. They sent me a new card with the same number (but new expirey). After discovering a fresh charge in the next yearly cycle, I called my bank to "contest" the charges. They asked if I had talked to them (the vendor, Yahoo in this case) or otherwise explicitly cancelled my "subscription" and told them I had no way of recovering my account information and wasn't about to navigate their phone-based customer service. My bank did absolutely nothing to help me. Moving forward, I've sought to minimize any form of accounts following this paradigm. Getting rid of passwords is great, long over due, but there are bigger problems with these organizations.

Quick question... assuming that this would work on all yahoo services.

Now imagine that I lose my phone, I guess that I will have to ask to receive a reset token, or something similar, on my yahoo mail, right?

But then how do I login on the mail service without my phone?

(it's a honest question)

Doesn't work with VoIP numbers e.g. Google Voice, so that's a non-starter for me.

I noticed Twitter did something similar the other day. I was trying to login from my phone, and after two failed login attempts, I got an email with a confirmation code that I could enter into the Twitter app (on my android phone) to login. The email said I could also use this "code" in place of my password.

> We noticed that someone recently tried to sign in to your Twitter account (...)

> If this was you, confirm your identity by using this temporary code: (....)

> You can also enter this code where you would normally enter your password when you sign in.

I couldn't tell whether the email was sent because the second password attempt was successful or because it wasn't successful.

This is a gift to hackers, government snoops, and the like: access is now granted to anyone with the trivial ability to intercept SMS messages, spoof cell towers (Stingrays), or clone SIM cards.

Best thing would be using a password protected key like in SSH. It should be baked in to SSL somehow to make it easier to password protect web apps.

It's a bit ironic that Yahoo changed their password policy so that I need to have at least two numbers and different caps and something like max ten characters. Making it impossible to remember the password.

I always use something like "magicunicornridingsousages" witch I find both easy to remember and long enough to prevent brute force. Too bad Yahoo wont allow it.

They need on-demand email addresses too, then. Because I don't remember my yahoo email address, either. That's how long it's been since I've signed in.

Maybe every other month for one reason or another I'm prompted to sign-in to Yahoo. I sit there for a frustrated three seconds wanting to punch the screen and then just close the page. Can't remember the email address, know I won't be able to remember the password and no way I'm dealing with creating a new account.

Instead of sending a SMS message to their phone, could Yahoo send a push notification (with TextSecure support)?

I'd like to see this. I'd love to help make it happen.

This isn't even 1 factor auth, this is 0 factor auth.. unless you accept the pain of disabling text message notifcations on your phone.

So now less security is better? I'm confused.

This is awesome, as long as you have phone service and have your phone with you. While I want my stuff to be secure, a hacker, nor government snooping isn't the highest priority. Allowing me to access my stuff is the highest priority. Passwords are a pain, but this isn't the solution (nor are biometrics)

From a general perspective , i see this to be a flaw.

But there are some use-cases where i see it to be useful.One is with old people (in 70s/80s) with little tech. exposure beforehand.They just need the phone with them and they don't care if someone reads/opens their emails from somewhere else for a time or two.

It won't be accepted by people. Imagine, what will happen if you forgot your phone with someone you know.

If you lose your phone, somebody would be able to log in to your email, although the problem is less serious in practice. It would require stealing the phone and then doing some nefarious activity with it before the phone and email account are blocked.

Now how many usernames do I need to know to get access to atleast one of them?

4 digits = 10000 usernames, with luck only half of them.

I have forgotten mine years ago already.