Hacker News Reader

What do you expect? Uber has no way to authenticate you if email doesn't work.

Technically they do - they could send an SMS to the registered number, which as OP points out, is unique.

There's also more than just phone. Could use the full credit card #. They can also send the device a push notification with a security token and have the user reset password with it in lieu of an email based token.

Could use the full credit card #.

I doubt they're storing that.

You're likely right, but they could always get crafty with Braintree APIs: https://developers.braintreepayments.com/ios+ruby/reference/...

Reply on news.ycombinator.com