Yahoo's New Disposable Passwords
Written by Lucy Black   
Tuesday, 17 March 2015

Yahoo has introduced on-demand passwords for accessing email accounts, doing away with the need to remember a strong password. Is this an idea that will catch on?

Yahoo's new scheme means that you can choose to do without a strong, and potentially difficult to remember password for Yahoo.

In the blog post announcing the new log-in procedure Chris Stoner, outlines the advantage of on-demand passwords:

We've all been there... you're logging into your email and you panic because you've forgotten your password. After racking your brain for what feels like hours, it finally comes to you. Phew!

Today, we're hoping to make that process less anxiety-inducing by introducing on-demand passwords, which are texted to your mobile phone when you need them. You no longer have to memorize a difficult password to sign in to your account - what a relief!

The idea of an on-demand passcode will be familiar to many from online banking - but in that context it is additional authentication and users still have to provide a password every time they access their accounts.

The difference with Yahoo's use of passcodes that it is instead of a password and once you have provided your mobile phone number and gone through the initial verification step future log-ins will use a new one-time code sent to your phone.




The on-demand option is already available to Yahoo's US customers to implement it a user selects it in the Account Security section of their account information:  




Future log-ins now need just your account user name and your mobile phone.

Is this secure?

Well phones can be stolen and user names can be guessed at. If someone has your phone they probably have enough information to work out your user name. The problem with memorizing "strong" user names is similar to that of strong passwords. If you make it difficult for someone else to discover it, you may find it difficult to recall yourself.

And what if you want to log into your email and discover you've not got your phone with you?

So what seems like a simplification just adds a different set of problems.

As a developer, you quickly discover that making accounts easily accessible to  legitimate users while at the same time secure from unauthorized access is beset with problems. 

A mobile phone is not a key to a secure account. 






More Information


A New, Simple Way to Log In 

Related Articles

Yahoo Launches Games Network

Yahoo Boosts Search Share


To be informed about new articles on I Programmer, install the I Programmer Toolbar, subscribe to the RSS feed, follow us on, Twitter, FacebookGoogle+ or Linkedin,  or sign up for our weekly newsletter.



APISEC Conference Sessions Now Available Online

The talks from APISEC|CON, the largest event dedicated to API security, are now available up on Youtube, for free. The virtual event covered AI and LLM security, defending APIs, API sprawl, gover [ ... ]

Perl v5.40.0 Shows That It Is Too Resilient To Die

Having faced doubt, debate and insecurity, Perl is still going after all those years, alive, kicking and making releases. Business as usual.

More News


kotlin book



or email your comment to:

Last Updated ( Tuesday, 17 March 2015 )