The result is that every visit to those sites is a password recovery exercise (click on the password recovery link, answer a personal question, receive a text message with a code or an e-mail with a link, enter the code/visit the link, invent a password that I will never use again, finally access the site).
My question is: why can't we just skip the invent a password that I will never use again stage?
Another question What are the benefits and drawbacks of emailing a user a login token/link? answers are:
- It requires e-mail access on the same computer (usability)
- It requires updating one's e-mail address with the site when the address is changed
- It is vulnerable to an attack on a single user e-mail
It appears that these issues are not as relevant for cell phone/sms approach.
- Are there security issues with this approach?
- Are there any sites which use this approach?