I don’t care about 2FA and Passkeys, they’re mostly fine. But I hate, hate, hate forced logins via magic links or 2FA by email or SMS.
That’s so true, I want 2FA that runs once a week per device and password login.
Yeah. Fuck those. I just now have this case, where I cannot login to a service I pay a subscription for. Contact support, wrote explicitly “I looked into the spam folder. I even looked into the logs of my mailserver, your mailserver does not even contact mine”.
Wait for two days, answer is (of course) “have you looked into your spam folder?”, nothing else. As soon as I manage to login, I cancel 😅 (jk, cancelled the payment already). Fuck those.
Bad link won’t autofill though because it’s the wrong url
There are plenty of ways.
DNS poisoning with one of those #4 private keys would be the easiest.
Getting Grandma to add a trusted CA would be another.
Paste bombs into browser terminals.
Something you have is a very important part of keeping people out of your stuff.
Once they are at the level where they break HTTPS, they can also ask you for the 2FA code or passkey and intercept that through their services, and you’d be hacked anyway.
The best bit is you go through all this drama and then some bloke finds a web form someone forgot to disable and gets access to everyone’s account with one click anyway.
Nah fucking email code every time! Just let me use ausernsme and password fucking god damned it. I don’t want my email involved in this process!
You forgot the “click to verify you are human” (followed by a dumb captcha, maybe 10) just after you click login but before logging in, which makes you, after you pass the captcha, click again to login.
Your password is 30 days old. Make a new one. It can’t be the same as any of your last 37 passwords.
Mark, is that you?
I love those send me a text 2FAs and they say the code will expire in 30 seconds. And they take forever to come in.
That’s what it feels like waiting the text and it finally comes in.
You should not be using SMS 2FAs anyways as they are very not secure (because of the SMS protocol).
Use TOTP whenever possible (the one where you use an app like Google Authenticator, but you typically should use other FOSS solutions)
this is like when you have to call a customer service phone line and they tell you to try the website
There are so many sites that force you to use the SMS 2FA, and I hate it!
For some logins I value so little i don’t even care to have a password on it, I really don’t give a shit if SMS isn’t secure.
Do yOu tRUsT tHiS maChiNe?
“No, but I’ll click yes this time because I know what you meant better than you do”
I hate passkeys. Fuck off with your passkeys. I will stop using Amazon because it won’t stop trying to add a passkey into my bitwarden
What’s wrong with passkeys? my preferred method. Hell I wish everything just used those and no email password shit
There’s a lot of other better reasons to stop using amazon, but if that’s the one for you, it’s still a victory if you stop using them.
Don’t forget, if you type in one of your other email addresses by mistake it says something like “sending you a magic link”.
Then it acts like you are signing in, but you are signing up, on a new account, oops, fuckers, just tell me it’s not a valid account.
By the way, having two accounts is not allowed, so we banned both accounts for violating EULA.
Microsoft’s is even worse.
- Enter username
- Enter password
- Click “stay logged in”
- Click “log in”
- Login successful!
- Page reloads to the username prompt
- Repeat steps 1-6. Sometimes (but rarely) repeat them multiple times.
- Now you’re actually logged in.
How hard is it to log in the user if the username and password were correct? If Microsoft can not figure out how to do this, why do other random websites work? Do those websites have some arcane knowledge being held away from Microsoft?
Watching the url bar when logging into MS Azure is quite the ride. It redirects one billion times.
Microsoft Login is genuinely one of the worst designed piece of software I have ever seen. It takes actual skill to login lol.
Microsoft oauth login in a browser: type in password, get pop-up “reusing passwords is a security risk. Change password now?”.
I sure wonder why the password to my AD account is the same as the password to my windows account. It’s almost like they’re the exact same account or something.
… I was using 1password to store my passkey(s). On Thursday, it failed to login to Microsoft for work.
“Your passkey is valid, but didn’t meet the criteria set by your administrators.”
Screw this, I’m going back to passwords. At least I decide where/how to store this.
Not recognized by password manager for some fucking reason
usually it’s because it’s either an extension interfering or the website declared username/password field with non-consecutive tab index, or the app doesn’t even support tabbing into password field at all
That’s the second text on the bottom :)
Or the password manager “typing” the password, but it doesn’t fill the box and then the manager dares to say “done!!” even tho it has not done it. Again and again, until you give up and manually add the password in.
Also… sends code to email account, which requires another round of login hoops.
I thought the last one was just my computer being glitchy. So what’s the deal with that?
Do you clear your cookies often? Or have any fingerprinting mitigation turned on? (I’m just throwing ideas out here, I’m not an expert on this stuff)
Fuck if I know. Cross site stuff probably.
What really grinds my gears is that every goddamn login site now has separate pages for username and password, so the Autofill {Username}{Tab}{Password}{Enter} scheme doesn’t work anymore.
Now you have to wait an unpredictable amount of time until you can enter your password.
Also another quck vent if someone from my bank is reading this: Please explain to me why I always have to 2FA my browser login with my phone, but not the other way around? How tf is that safer when I can do anything solely on my phone anyway, which has no 2nd factor?
CSAM, my governments authentication platform (before the abbreviation got hijacked) changed the {Username}{Tab}{Password}{Enter} sequence by adding a question mark button next to the username field that is z-indexed between username and password field.
I opened a ticket and a few months later got a reply that it’s an accessibility standard…
So now, after typing in my password and hitting tab, I’m always typing my password into the void.
How is any of this related to CSAM at all?
Yeah, I’ve had a few of those and had that happen.
At least, in that case, you can add a second tab to the sequence. It’s annoying and shouldn’t be necessary, but that should work.
The thing with the two pages is, I never know how long they load and (I have to criticize Keepass) entering “DELAY X-ms” doesn’t really wait for that amount of time, if I enter 10000, it doesn’t wait 10s, more like 2.
So there are two factors I have no clear control over. Should I just enter 100,000,000 and wait a minute every time to login?
I agree it’s stupid, but if you want to know why, here’s a link: https://news.ycombinator.com/item?id=20294523
I figured it was related to some shit like that.
At least with hardware authenticators, I could understand.
But of course, it is more accomodation for people who are too stupid to keep more than one account and don’t care about privacy at all. Great.
Don’t know what I still expect.
Unfortunately, that page does not explain much. So many meaningless comments. As usually with that garbage site.
