Hacker News Reader

It's not completely dumb. Address verification can be part of an identity verification measure. It shouldn't be the only one, and an override should be possible, but it's completely valid and effective at thwarting remote attacks.

Sure, the logic lines up. I think it’s dumb just because how un-useful it is. Waiting for a week for a password reset to arrive in the mailbox is pretty painful.

Pretty secure I suppose, except in the OP’s case, where it was sent to an old address. And they wouldn’t update it over the phone? So they essentially gave some strangers access to his bank account.

it's a thing. my bank has even special paper that obfuscates the password so you can't see it through the envelope.

Totally happens in Sweden