NEW YORK: On-demand passwords sound super convenient for people who are incapable or simply unwilling to remember their passwords. The trade-off is that now it’s a whole lot easier for someone you know to sneak into your account, all they need is to get their hands on your phone for a few seconds. They don’t even need to unlock your phone if the SMS pops up on the lock screen.
If it’s too hard to remember your email password, Yahoo will just make one up for you.
Finding the right level of online safety has always meant striking a balance between security and convenience, but Yahoo may have tipped the scales too far with its trial of SMS-only passwords.
After a number of high-profile security breaches, many online services now offer the option of two-factor authentication. When you try to login from a new device for the first time, you’re asked to enter both your password and a secondary code which is sent to you as an SMS (or else is generated by a mobile app).
The benefit of two-factor authentication is that access to your account now relies on both something you know (your password) and something you have (your phone) – just one isn’t enough to get you in. To make things more convenient you can tell your account to trust your devices. This way you don’t need an SMS code every time you login from your own computer, but a stranger trying to break into your account from their computer still needs to know your password and have your phone at hand.
Understandably not everyone wants to go through the hassle of setting up two-factor authentication, but for some people even that first factor of remembering their password is too much to ask. Rather than encouraging them to lift their game, Yahoo is pandering to them by trialling “on-demand” passwords in the US basically two-factor authentication without that all important first factor of something you know. Instead on-demand passwords rely solely on the second factor of something you have in this case your mobile phone.
You’ll still need a password to manage your Yahoo account, where you can dip into the settings and enable on-demand passwords. After this, type your login into a Yahoo page and you’ll see a “Send my Password” box where the password field should be. Hit the button and a four-character code is texted to your phone, which is all you need to login.
People often justify their lax approach to online security by stating that they don’t have anything to hide and hackers won’t find anything of worth when trawling through their inbox. You can bet that those people still value their privacy and wouldn’t want their partner, family or friends reading through all their email. That’s exactly what you’re leaving yourself open to if you enable Yahoo’s on-demand passwords.
It’s not hard to devise a simple system for remembering strong and unique passwords. People who can’t be bothered making the effort get the security level they deserve. How do you strike the best balance between online security and convenience?
