I love those send me a text 2FAs and they say the code will expire in 30 seconds. And they take forever to come in.
That’s what it feels like waiting the text and it finally comes in.
You should not be using SMS 2FAs anyways as they are very not secure (because of the SMS protocol).
Use TOTP whenever possible (the one where you use an app like Google Authenticator, but you typically should use other FOSS solutions)
For some logins I value so little i don’t even care to have a password on it, I really don’t give a shit if SMS isn’t secure.
Do yOu tRUsT tHiS maChiNe?
Don’t forget, if you type in one of your other email addresses by mistake it says something like “sending you a magic link”.
Then it acts like you are signing in, but you are signing up, on a new account, oops, fuckers, just tell me it’s not a valid account.
I hate passkeys. Fuck off with your passkeys. I will stop using Amazon because it won’t stop trying to add a passkey into my bitwarden
Not recognized by password manager for some fucking reason
usually it’s because it’s either an extension interfering or the website declared username/password field with non-consecutive tab index, or the app doesn’t even support tabbing into password field at all
That’s the second text on the bottom :)
Or the password manager “typing” the password, but it doesn’t fill the box and then the manager dares to say “done!!” even tho it has not done it. Again and again, until you give up and manually add the password in.
Microsoft’s is even worse.
- Enter username
- Enter password
- Click “stay logged in”
- Click “log in”
- Login successful!
- Page reloads to the username prompt
- Repeat steps 1-6. Sometimes (but rarely) repeat them multiple times.
- Now you’re actually logged in.
How hard is it to log in the user if the username and password were correct? If Microsoft can not figure out how to do this, why do other random websites work? Do those websites have some arcane knowledge being held away from Microsoft?
Microsoft Login is genuinely one of the worst designed piece of software I have ever seen. It takes actual skill to login lol.
… I was using 1password to store my passkey(s). On Thursday, it failed to login to Microsoft for work.
“Your passkey is valid, but didn’t meet the criteria set by your administrators.”
Screw this, I’m going back to passwords. At least I decide where/how to store this.
Also… sends code to email account, which requires another round of login hoops.
I thought the last one was just my computer being glitchy. So what’s the deal with that?
Fuck if I know. Cross site stuff probably.
Do you clear your cookies often? Or have any fingerprinting mitigation turned on? (I’m just throwing ideas out here, I’m not an expert on this stuff)
1Password has been my go to. It will autofill 2FA if I register it with 1PW. The sites that still send text and don’t allow authenticator apps still bug the shit out of me.
Yes, but then you have your 2fa codes along with your passwords in the same store. Which somewhat defeats the purpose of 2fa
Somewhat, but the 6 digit code still rotates and my master password is miles long. Then you need to get past the security on the device that it resides on, so that is technically a second factor.
completely defeats the point of 2FA. that is 1FA
If your password manager is compromised, sure.
But that’s less likely than whatever random website getting compromised and having stored your password in plaintext, so the 2FA stored next to your password in your password manager still protects you from that
What really grinds my gears is that every goddamn login site now has separate pages for username and password, so the Autofill {Username}{Tab}{Password}{Enter} scheme doesn’t work anymore.
Now you have to wait an unpredictable amount of time until you can enter your password.
Also another quck vent if someone from my bank is reading this: Please explain to me why I always have to 2FA my browser login with my phone, but not the other way around? How tf is that safer when I can do anything solely on my phone anyway, which has no 2nd factor?
I agree it’s stupid, but if you want to know why, here’s a link: https://news.ycombinator.com/item?id=20294523
some fuckass website i’ll use thrice in my life: you NEED to add a passkey. for SECURITY. it’s IMPORTANT. DO IT!
my bank: heyyyy wanna do 2fa? it’s ok if u don’t… oh u do??? yaysies! ^w^ okay so. we can do sms or app notification :3
Better: face recognition. In AI age.
Also the bank:
Wtf are you doing m8? Why your password so fucking long? Keep it to max 6 characters, like a sane person.
Those are some crazy charicters I’m going to need you to keep it letters and numbers only if you know what I mean.
This bugs the hell out of me. Why does my Xbox account have better security than my bank?
One product comes from a technology company… the other a bank.
And the bank is supposed to care about security
Because your Xbox account is owned by Microsoft, which has a hidden interest in increasing passkey acceptance other than “it’s more secure”.
What do you mean? What’s wrong with passkeys?
You guys don’t just reset your password every time you log in to something you don’t use daily? They’ll never get my password if even I can’t remember it, moving target!
“Passkey already created for this device”
Don’t forget it starts off with only an ‘email’ field and only shows the password field after you fill that out and click a button, just to make sure that the login flow is as crap as possible for your password manager to deal with.
Those are really annoying. They sometimes cause trouble with autofill and it means jumping through 3 pages if 2FA is enabled.
That’s fine. There’s multiple reasons to do that, most notably SSO stuff.
There isn’t any good reason, it breaks password managers. Just give people with special accounts their own log in page.
Even worse:
Page 1: enter email or phone number
Page 2: enter password
Page 3: enter 2FA
okay, but why the fuck am I entering a password if you’re forcing me to use 2FA?
Corposluts: “iTs MoRe SeCuRe”
BITCH - If I can fucking reset my password with the same email/phone number I use to receive my 2FA, then the password is functionally useless
Even worse: instead of your email or phone number. It’s not even username. It’s your fucking account number. I’m looking at you airline and hotel rewards programs. You think I know my fucking account number? Now I need to go into my email and lookup my fucking Airline Advantage number? And Gmail search is complete shit and all of the results I get are from the airline in my spam folder so I have to dig through all of that. Then when I finally do find it, fuck me if I can remember my password because I travel like once every couple of years and I’m hoping that if I keep saving up all of my points then maybe I can get a free flight to a neighboring city in 20 years…
You sound upset, can I offer you a complimentary bag of peanuts? They’re 60% nitrogen!
Well it wouldn’t be 2fa if you don’t use a password. Then it’s just 1fa.
(in case you didn’t know, 2fa stands for two-factor authentication, as in secondary authentication (usually besides a password))
As pointed out, if password can be reset from the same email you receive 2fa codes then it’s 1fa with extra steps.
Damn do I hate websites that do this. It’s always a gamble if Keepass can handle their stupid multi-page form correctly.
I tend to keep my ass in my pants, not always, butt usually.
this was the first time I read that as Keep ass
I choose to read it and pronounce it as keep ass every time
We are not the same
