I love those send me a text 2FAs and they say the code will expire in 30 seconds. And they take forever to come in.
That’s what it feels like waiting the text and it finally comes in.
You should not be using SMS 2FAs anyways as they are very not secure (because of the SMS protocol).
Use TOTP whenever possible (the one where you use an app like Google Authenticator, but you typically should use other FOSS solutions)
Not recognized by password manager for some fucking reason
usually it’s because it’s either an extension interfering or the website declared username/password field with non-consecutive tab index, or the app doesn’t even support tabbing into password field at all
Or the password manager “typing” the password, but it doesn’t fill the box and then the manager dares to say “done!!” even tho it has not done it. Again and again, until you give up and manually add the password in.
That’s the second text on the bottom :)
Don’t forget, if you type in one of your other email addresses by mistake it says something like “sending you a magic link”.
Then it acts like you are signing in, but you are signing up, on a new account, oops, fuckers, just tell me it’s not a valid account.
Also… sends code to email account, which requires another round of login hoops.
Microsoft’s is even worse.
- Enter username
- Enter password
- Click “stay logged in”
- Click “log in”
- Login successful!
- Page reloads to the username prompt
- Repeat steps 1-6. Sometimes (but rarely) repeat them multiple times.
- Now you’re actually logged in.
How hard is it to log in the user if the username and password were correct? If Microsoft can not figure out how to do this, why do other random websites work? Do those websites have some arcane knowledge being held away from Microsoft?
… I was using 1password to store my passkey(s). On Thursday, it failed to login to Microsoft for work.
“Your passkey is valid, but didn’t meet the criteria set by your administrators.”
Screw this, I’m going back to passwords. At least I decide where/how to store this.
Microsoft Login is genuinely one of the worst designed piece of software I have ever seen. It takes actual skill to login lol.
I thought the last one was just my computer being glitchy. So what’s the deal with that?
Do you clear your cookies often? Or have any fingerprinting mitigation turned on? (I’m just throwing ideas out here, I’m not an expert on this stuff)
Fuck if I know. Cross site stuff probably.
1Password has been my go to. It will autofill 2FA if I register it with 1PW. The sites that still send text and don’t allow authenticator apps still bug the shit out of me.
Yes, but then you have your 2fa codes along with your passwords in the same store. Which somewhat defeats the purpose of 2fa
Somewhat, but the 6 digit code still rotates and my master password is miles long. Then you need to get past the security on the device that it resides on, so that is technically a second factor.
completely defeats the point of 2FA. that is 1FA
If your password manager is compromised, sure.
But that’s less likely than whatever random website getting compromised and having stored your password in plaintext, so the 2FA stored next to your password in your password manager still protects you from that
What really grinds my gears is that every goddamn login site now has separate pages for username and password, so the Autofill {Username}{Tab}{Password}{Enter} scheme doesn’t work anymore.
Now you have to wait an unpredictable amount of time until you can enter your password.
Also another quck vent if someone from my bank is reading this: Please explain to me why I always have to 2FA my browser login with my phone, but not the other way around? How tf is that safer when I can do anything solely on my phone anyway, which has no 2nd factor?
I agree it’s stupid, but if you want to know why, here’s a link: https://news.ycombinator.com/item?id=20294523
You guys don’t just reset your password every time you log in to something you don’t use daily? They’ll never get my password if even I can’t remember it, moving target!
some fuckass website i’ll use thrice in my life: you NEED to add a passkey. for SECURITY. it’s IMPORTANT. DO IT!
my bank: heyyyy wanna do 2fa? it’s ok if u don’t… oh u do??? yaysies! ^w^ okay so. we can do sms or app notification :3
Also the bank:
Wtf are you doing m8? Why your password so fucking long? Keep it to max 6 characters, like a sane person.
This bugs the hell out of me. Why does my Xbox account have better security than my bank?
Because your Xbox account is owned by Microsoft, which has a hidden interest in increasing passkey acceptance other than “it’s more secure”.
What do you mean? What’s wrong with passkeys?
One product comes from a technology company… the other a bank.
And the bank is supposed to care about security
“Passkey already created for this device”
Don’t forget it starts off with only an ‘email’ field and only shows the password field after you fill that out and click a button, just to make sure that the login flow is as crap as possible for your password manager to deal with.
Those are really annoying. They sometimes cause trouble with autofill and it means jumping through 3 pages if 2FA is enabled.
That’s fine. There’s multiple reasons to do that, most notably SSO stuff.
There isn’t any good reason, it breaks password managers. Just give people with special accounts their own log in page.
Even worse:
Page 1: enter email or phone number
Page 2: enter password
Page 3: enter 2FA
okay, but why the fuck am I entering a password if you’re forcing me to use 2FA?
Corposluts: “iTs MoRe SeCuRe”
BITCH - If I can fucking reset my password with the same email/phone number I use to receive my 2FA, then the password is functionally useless
Even worse: instead of your email or phone number. It’s not even username. It’s your fucking account number. I’m looking at you airline and hotel rewards programs. You think I know my fucking account number? Now I need to go into my email and lookup my fucking Airline Advantage number? And Gmail search is complete shit and all of the results I get are from the airline in my spam folder so I have to dig through all of that. Then when I finally do find it, fuck me if I can remember my password because I travel like once every couple of years and I’m hoping that if I keep saving up all of my points then maybe I can get a free flight to a neighboring city in 20 years…
You sound upset, can I offer you a complimentary bag of peanuts? They’re 60% nitrogen!
Well it wouldn’t be 2fa if you don’t use a password. Then it’s just 1fa.
(in case you didn’t know, 2fa stands for two-factor authentication, as in secondary authentication (usually besides a password))
Damn do I hate websites that do this. It’s always a gamble if Keepass can handle their stupid multi-page form correctly.
I tend to keep my ass in my pants, not always, butt usually.
this was the first time I read that as Keep ass
I choose to read it and pronounce it as keep ass every time
We are not the same
The worst way of login:
Login with Google
Login with Facebook
Login with GitHubFollowed by the login that doesn’t let you use a password but sends you a mail with a link instead. Straight from hell.
I do this, for my own website, and for one simple reason: I don’t want to store passwords. I just want a proof your control the email (the website is based on notifying people)
Even worse. They automatically create an account if you don’t already have one through the login mechanism, so you get multiple accounts that can’t be merged.
you get multiple accounts that can’t be merged.
- microsoft
- github (owned by microsoft)
Huh? That’s a thing?
I coded a SSO like that where all you did was put in an email and put the code in in like 2nd year of work as a dev.
Is that seriously an issue where that can cause duplication on some platforms?!
I think they mean where it tries to send a magic link, and say you signed up under name@yourdomain.com, but also have a Gmail or whatever and you forget and enter name@gmail.com, then it acts like it’s logging you in, but now you have an account also at name@gmail.com.
No that’s weird to me. Even if you connect different social auths the platform should connect to the same email address
should
That is a key word there. Not all of them do. And it’s enough to be a noticeable pain in the ass.
I hate that Microsoft/Google have 1 account for hundreds of services. I want a different account for each service but that requires logging out and back in multiple times.
Firefox is the answer.
Get Firefox, and get the container plug-in. It lets you assign sites to containers so for example if you have different account for Xbox and office and GitHub, you assign them each to their own container and it doesn’t share cookies between them. Result is you stay logged in the way you want and you never have to switch accounts.
