Hacker News Reader

Storing a token isn't really much more secure than storing the password itself. (If I steal your token, I'm buying coffee with your account even though I don't know your password. A token that authenticates account access is a password.)

But it seems much more secure (which, it turns out, matters) and it does somewhat protect people who reuse the same password everywhere.

View on HN

You can invalidate tokens for a compromised phone. Well you can also change your password, but I'd rather revoke the access from my phone than have my password stolen. Some kind of validation mechanism before you order could be nice (like a screen lock), something you can do with one hand.

Many services grant fewer capabilities to a session authenticated only by token. In the case of Starbucks, you can buy a coffee or even reload the card from the user’s bank account via the app, but you need the password and the web site to change the user's mailing address. Therefore, this vulnerability might enable an exploit such as draining your bank account into gift cards that I send to my address, whereas access to your phone and token would not.

Reply on news.ycombinator.com