Hacker News Reader

This is fine until a platform or service decides to lock his account or permanently disable it because of frequent password reset attempts. If he’s lucky, he may be able to use a phone number connected to the account to get in. If not, then that’s the end of it. Seeing the kind of login patterns that many sites track for security reasons and how bad their judgments can be, I personally wouldn’t take such a risk.

Given a scheme is only ever as secure as its recovery process, he's not wrong.

I do that for some services I rarely use. That works actually fairly well.

OTP, with extra steps :D