Hacker News Reader

Granted that is on a phone where you can usually just swipe left to their email application and run through some forgot your password steps - also the 2FA that most people use is just SMS which goes to the same place.

Assume that if someone has your unlocked phone they own your life.

The concern with SMS is SIM cloning. An aspiring code thief doesn't need your phone once they can pretend to be your phone.

My favourite was when I needed to enter the second and fifth caracter of my password, and seventh and ninth digit from the login number. These are surely hashed in the database! (Metro Bank UK) not banking with them anymore.

Many must also store them in plaintext as well, or something like it, because the operator has to be able to confirm the spoken password for telebanking.

Oh and it changes every 6 months "for security reasons" thus guaranteeing it's either very simple or you write it down!