SOT: Amazon login problem

As this thread has demonstrated, people are wary of passkeys, either because they haven't heard of them, don't understand them, or are suspicious why they are being 'forced' onto them ...

There's probably no chance of Joe Public understanding the tech, but then Joe Public probably thinks websites store passwords "as entered" and compare the value when logging-on, rather than comparing hashes ...

In general, Joe Public does not think.

?? Are Google and MS not mega-corporations? Together with Amazon, they are the first names that come to mind if that category is mentioned.

One major issue is the tendency for Big Tech who don't do customer support to wash their hands of you if you lose your passkey. 'Oh, you wrote down the 6 digit recovery codes but we changed them to 9 digits, sorry you're out of luck. That account cannot be recovered now'. (this actually happened to me this week)

For banks there's always a backup route by sending you a letter or going into a branch with your passport, but that costs money and trillion dollar online companies are tightwads.

Theo

If I'm not on my computer which has the fingerprint reader, i can just login to amazon with password instead, and if I forgot the password I could request a reset email. I did have MFA enabled, but found that negated the convenience of fingerprint logon.

To slightly change topic, has anyone noticed a new trend for requiring an email address without password, then emailing a single-use login link?

So far STwater and Rightmove seem to be doing this, seems more of a faff than letting users store the password in a password manager, any other sites part of this trend?

All sorts of crap are appearing.

Usual one for me is a name/password and THEN an SMS message with a one-time key

NHS sends me one time links, but they are almost useless since I cant transfer them from phone to computer except by typing

Fortunately I can log in to the various NHS apps and navigate to the 'new documents' section anyway.

thats not much different to what PayPal do

and not much different from using a PinSentry to get access to an online bank account

Maybe it's been a long time since I used paypal, I have a password and MFA by my phone authenticator set.

But it's hassle if the email link arrives on a different device than the one you were trying to login from.

They sent me a text message when I used it yestaerday

The bank doesnt send an email - it asks you to use the PinSentry and you then enter the number

But I will admit that just having the PinSentry is also a bit of a faff (although I have 2 of them)

I don't mind the hassle of a pinsentry (I have the app on my phone and the backup option of a physical pinsentry) it does provide security.

But rightmove and the water board don't need extra levels of security, just a password (with email reset facility) would suffice.

As the meme (approximately) goes: "Why do I have to prove who I am to pay a bill? I don't mind if someone else fraudulently pays it."

and that goes straight to the heart of the https "problem"

It's phishing protection. You might be using a password manager, but other people could be tricked into entering their details into a fake site. The law requires that some kind of 2FA is involved, and they have decided that since you're going to have to do an email 2FA anyway you might as well skip the password step.

Slack does it too, and I'm sure I've seen it on other sites as well. At least with Slack they email you a login code. It gets annoying when they require you to click a link in the email, when you may be logging in on a computer that doesn't have access to your email.

Theo