forgotpw.com

Why don't I have to log in to use Rosa?

Your passwords are never displayed on the screen, the only way to extract them is by text message to your mobile phone. Likewise, to store a password you will have to confirm by text message to your phone that you originated the request. This serves as a form of authentication instead of requiring yet one more password you're just going to forget.

Are SMS text messages secure?

The reality is we are already depending on SMS text messages as a means of authentication to secure our most important accounts.

Are you going to bother me with unwanted text messages?

No, Rosa will only respond to your requests, not spam you out of the blue.

If someone else gains access to my phone, doesn't that mean they can gain access to my passwords?

If you're following our recommendation to use a common password, even if someone were to gain access to your phone, they would not know your complete password. You may also be using things like your browser’s ability to remember your passwords. If you step away from your computer you have the same concern. Most people however have their phones on them at all times, it is the one thing you are almost never without.

Aren't the readable passwords you recommend (like “sublimecrocodile”) less secure than long strings of random characters?

When combined with a common password like 15AZ!$, the passwords are more secure. Additionally, many websites have measures against brute force attacks such as locking your account out after a number of failed attempts. You can also take into account the importance of the site you are storing a password for, and if you like you can use a more difficult to type password for your brokerage account for example.