Single-use password as the default authentication method?

Question

The crazy password requirements (joke1, joke2) lead me to a situation where there is no way for me to memorize the passwords to the several sites that make those requirements.

The result is that every visit to those sites is a password recovery exercise (click on the password recovery link, answer a personal question, receive a text message with a code or an e-mail with a link, enter the code/visit the link, invent a password that I will never use again, finally access the site).

My question is: why can't we just skip the invent a password that I will never use again stage?

Email

Another question What are the benefits and drawbacks of emailing a user a login token/link? answers are:

1. It requires e-mail access on the same computer (usability)
2. It requires updating one's e-mail address with the site when the address is changed
3. It is vulnerable to an attack on a single user e-mail

SMS

It appears that these issues are not as relevant for cell phone/sms approach.

So,

1. Are there security issues with this approach?
2. Are there any sites which use this approach?

Answer 1

Are there any sites which use this approach?

This sounds very similar to Yahoo's on-demand passwords.

Yahoo announced that in lieu of a standard username-password combination, Yahoo users in the US could log into their accounts with one-time passwords sent to their mobile phones via SMS message.

---

Are there security issues with this approach?

Yes, like the email approach is vulnerable to an attack on an email account, this is vulnerable to an attack on a device. The device could be stolen, or if it is a smartphone malware could be engineered to access SMS messages and send them to an attacker. Also, consider what happens if the phone is lost or the SIM expired (say it was an old phone and you only just realised you needed it to access your account).

The crazy password requirements lead me to a situation where there is no way for me to memorize the passwords to the several sites that make those requirements.

The result is that every visit to those sites is a password recovery exercise (click on the password recovery link, answer a personal question, receive a text message with a code or an e-mail with a link, enter the code/visit the link, invent a password that I will never use again, finally access the site).

This is already a solved problem. Get yourself a password manager, protect all your accounts with a strong, memorable master password and then you can retrieve everything without remembering individual username and password combinations.

Answer 2

A couple of sites therefore allow you to log in with e.g. OpenID, Google or Facebook, thereby removing the need for separate credentials.

Facebook has also introduced one-time login tokens ("passwords", OTP).

Regarding SMS, remember that SMS are clear-text messages that are only protected if the link between your device and the cellular network provider and the provider's and your device's storage are encrypted.

It is known that SMS have been intercepted in several cases (at least on end devices and over the air), so they should only be considered a nice second authentication factor but should be used as the only factor for very low-value applications only at best.

Like SilverlightFox said, a password manager is a recommended option for one-shot (e.g. e-cards) and non-critical sites like Facebook or even critical sites if you trust the password manager and yourself, or if the site uses a second authentication factor for critical actions, like Internet banking does.

The danger of using a password manager is that once your device / manager is compromised, all stored credentials will be, too, and you may not even know it for a long time.