Side rant:

To make it worse, SMS is incredibly insecure. Nothing should send you codes via SMS, and if you have the option to use an authenticator app, do that. It's atrocious so many banks only have SMS as an option.

The really dumb part is, the SMS codes are literally the same authenticator algorithm, but running on their servers and sent to you via an insecure medium.

It is coding for the lowest common denominator of user -- those who use the same easily-guessable password for everything. Making them click a link to login is honestly better security.

Of course there should be an option for those of us who have a TOTP app and use a password manager.

Personally I’m frustrated with always having to give a working phone number to accounts.

I have no idea if I’ve been at all successful in poisoning my data but all my accounts use unique generated emails in addition to generated passwords and fake profile info. It’s just habit now.

However all too often the one piece of real data I have to give is my phone number, and that would be really useful to cross-link all my accounts for data brokers building a dossier on me.

I have hundreds of fake emails but can create at most a couple phone numbers

Outsourcing the securiry risk to a third-party

They're offloading authentication to your email provider. It's basically quick and cheap oauth. I think it's because they're trying to avoid being a vector for a data breach.

My previous bank does this sends an SMS. Extremely insecure & also pointless if a would be thief has my phone (if im stupid enough to use no/easily guessable PIN) or has compromised it.

Is there not an argument that password managers have been around long enough now that anyone reusing logins & easily guessable passwords responsible for their own stupidity? We all know not to leave our doors & windows wide open when we go on vacation.

gg ez ease of use feature, which is hilarious because that's exactly where smishing attacks come in. People are actually more willing to give out the OTP than their actual password, so it definitely less secure.

I think this started out as a decently good idea, like sign in with a device type of feature (think QR code from an authenticated device), but then along the way someone just went "screw it" and changed it to an OTP.

Even in 2025 password managers are rare, people still reuse the same 8 character password everywhere, and people fall for low effort scams. So someone thought "if they're gonna be insecure anyway, lets just make it so they never have to use a password and sync it to their phone or email".

I'm paranoid so I view passkeys and similar streamlined login mechanisms as a way to make it easy for police to access your entire digital life once they unlock your phone.

This is why manufacturers started pushing biometric unlocking so hard. Once someone has access to your person and phone they no longer need PINs or passwords to gain access to everything.

I hate the SMS ones, because I don't have a good phone signal in my home, so I have to ruin around trying to get a couple of bars so I can get the effing code. My banking app just uses a fingerprint.

i have no proof, but im semi sure that this way you cannot sign up with a temp mail or temp sms, so you are kinda forced to use your real data, which means the site is selling your data

Because people don't realize how ridiculously insecure SMS and (usually unencrypted) email are.

It's just kids who never had a mentor.

Can't be liable for theft if there were no locks?

From my experience things like this are not important services. they are things where I keep the password in an online password service which I won't do for anything important.

It's an immediate red flag for me.

Which services? I haven't stumbled upon a single one

Too many big password breaches also occurred to me.

I think to reduce friction for gaining new users.