How do you keep track of all your accounts then?
Even with a credentials manager, it's quite a chore to remember where on the web you have accounts. Almost every single site you visit will ask you to create a login, for shopping, to receive newsletters, for whatever reason.
People start to use credentials managers once they realise they have so many accounts they can't remember them all, but by then it's too late.
Even if you don't re-use passwords, most people do not use different email addresses for the account usernames. It's just too difficult to do that when you have a myriad of accounts everywhere.
The whole system with logins using passwords and email addresses broke down some years ago as the internet grew massive. We still persist with it, and the problem's getting worse. Changing passwords won't fix it.
Now, there are some efforts to plaster over the cracks, like authentication methods that don't pass through user credentials, but they are difficult to get right and have their own set of horrendous security bugs.
Then there's two-factor and two-step authentication where you enter username and password, and then through a side-channel you're asked to either permit the login attempt, or you enter a code to authorise it.
It means jumping through more hoops for logging in and some people don't enable 2FA/2SA for that reason. You should do that, because it's literally a last line of defence since the chances are your username is out in the wild, and your password could be too if it isn't already.
Not that 2FA/2SA is 100 per cent secure either, as Apple customers have discovered.
The whole system with logins using passwords and email addresses broke down some years ago as the internet grew massive. We still persist with it, and the problem's getting worse.
For the past month or so, Apple users have reported that their devices have mysteriously become locked. People are asked to send an email to an address on the iDevice lock screen, and in some cases money is demanded - a ransom.
The reason for the lock-outs seem to be attackers working out how to abuse the Find my iPhone feature.
They obtain usernames and passwords, the latter sometimes through brute-force guessing, and log in to victims' iCloud accounts. If 2SA is enabled, attackers will be prompted for a code that they can't enter and get in but... they can still use Find my iPhone and through that, lock people's devices.
I was able to confirm that you can access Find my iPhone and through that lock iDevices and Macs that are tied to your account, without entering the 2SA code.
This is apparently how it should work so that you can lock (and erase) lost devices when you only have your username and password available. Apple did not respond when I asked them but it's a case of damned if they do, damned if they don't.
Either way, if your device is locked, don't pay a ransom: try unlocking from another device, or go to an Apple service centre with proof of purchase for help.
That even a well-designed security feature like Apple's 2SA can be exploited like this shows why we need to move away from old-fashioned logins so as to make all that leaked data that's probably linked to each of us useless for hackers.
Kill logins sooner rather than later, please.
