It is not being fixed because the people that decide whether it needs fixing or not are so wealthy that they have dedicated servants to take care of that drudgery. You’re an NPC that is a programmable cog in their passive cash flow generator, not a person.
Click login button -> Use your passkey -> Done
Does it let you paste the passkey?
Does it let you do normal work with the passkey and not just take a backup or reset your password?
Does it let you use the same passkey multiple times or do you just have to create a new passkey every time?
Find login button hidden on signup page
This one makes me irrationally angry
no, it’s rational
It has the same energy as insurance companies or ISPs that only offer good deals to new customers.
Logging in is a 17 button process these days.
My job uses a Yubikey, authenticator, and more than 6 passwords, one of which for some damn reason at random points in a day thinks I’m on a seperate machine and forces me to get a verification code in my email. On top of that, one password resets every 3mo, another at 3 weeks, and the others are like every 8mo. All remember past passwords, will not allow any variation or similarity (you had a twelve char password with a number at the end in 2021, try another). It is a damn struggle creating a new password 12 years in now.
Are you allowed to use a password manager, like 1password or Bitwarden? I juggle with docens of passwords per client, all with different expiration dates and complexity rules. A password manager is the only reason I can get them all straight. A good password manager should let you save your passwords, passkeys, recovery codes and MFA codes all in one app locked with a single password + MFA
How much time do you spend on that per week?
I just paid all of my bills and had to login to each account. Once a month torture session lol.
i just have my bank do that.
I don’t like to automate it because I get paid every other week and it falls on different days. I just pay my bills first thing when I get paid so I know for sure it’s paid and didn’t bounce
Don’t forget to accept the cookies [YES] [no]
Don’t not deny allowing access to remove access to cookies!
Except you accept cookies in X browser, but not Y browser because that is an emulated system to run a 30yr old program they never bothered to update because it worked great on x86 machines but was never designed for 64 bit.
Website Title [Sign Up] ~[log in]~
I don’t mind 2FA and Passkeys, they’re mostly fine. But I hate, hate, hate forced logins via magic links or 2FA by email or SMS.
2fa over email is light years better than 2fa over sms for a whole slew of security reasons.
That’s correct (at least most of the time), but it’s still terribly inconvenient.
Yeah. Fuck those. I just now have this case, where I cannot login to a service I pay a subscription for. Contact support, wrote explicitly “I looked into the spam folder. I even looked into the logs of my mailserver, your mailserver does not even contact mine”.
Wait for two days, answer is (of course) “have you looked into your spam folder?”, nothing else. As soon as I manage to login, I cancel 😅 (jk, cancelled the payment already). Fuck those.
Yah the first time I saw it I was like wow so clever, but now I’m like why do you disrespect our purest form of online speech for your transactional babble
That’s so true, I want 2FA that runs once a week per device and password login.
What other 2FA methods are you looking for? I have seen a couple sites that will call you, but that is really just verbal text messaging.
The stay logged on and trust this system actions are probably controlled by a browser cookie, so won’t work if you don’t allow cookies from that site.Timed One Time Passwords (TOTP). It’s what Google Authenticator and a lot of other 2FA apps use.
a magic link is not 2FA if it doesn’t also require a password. it’s 1FA, they just replaced the one factor.
honestly i really hate websites that do that and yet don’t allow password-only 1FA. like sure, i understand that the average user’s password discipline is crap, but as a power user i’d really like it if all my accounts weren’t tied to all my other accounts sometimes.
2FA auth codes, like Ente Auth, or Okta.
even if you clear your cookies, the session token id still exists for the website
Some websites treat the first login you ever done as a sort of root of trust, for example for account recovery they might ask if you can to verify it is you on that session
Some websites use the number of login sessions and how many recent times you have logged in for theie hidden trust factor, and some may even lockdown your account if it gets too low automaticly
everyone knows to clear their cookies but absolutely nobody thinks to clear their localStorage, sessionStorage, or indexedDB. i have never once in my life seen someone include those when telling someone else to “clear their cookies.” even including cache in that list (e.g. using ctrl+shift+r to refresh the page instead of ctrl+r) is weirdly uncommon.
The stay logged on and trust this system actions are probably controlled by a browser cookie, so won’t work if you don’t allow cookies from that site.
In my experience, they are. In my bowser, I have to explicitly allow the saving of site data if I hope to be able to keep myself logged in. For me, this is fine; I only want to stay logged in on a handful of sites anyway so the tradeoff between adding an exception for some sites vs. allowing every single site I visit to be able to save some piece of data doing god-knows-what (likely helping Facebook and the like track where it is I visit) on my machine is worth it.
Why does this meme presume a log in is even necessary!!
It doesn’t
Logging in shouldn’t feel like passing an exam. Just let us access our accounts!
bot
Security is important, no doubt. I just think logging in should be secure without making the whole process unnecessarily complicated.
if ousing 2fa code is “like passing an exam,” maybe the internet is too hard for you.
Not all 2fa methods are created equal. “Shit … where did I put my RSA fob?”
And yes: I know there’s an app. The day my employer gives me a phone I might switch to it.
Finally bout up sign in ~ "iS tHis YoU???!!? [yes][no] "
I got a new phone and tried using the Merlin birding app but now I need to enter an email, receive an email, confirm using the link in the email…
…and then enter the user name and password I’ve been using to log into the app for years.
And it’s not just once but every time I use the app, it’s a nightmare, and I don’t want to give any extra information I don’t have to.
The best bit is you go through all this drama and then some bloke finds a web form someone forgot to disable and gets access to everyone’s account with one click anyway.
or social exploit the company’s IT, or a wordpress plugin, an AD vulnerability
I love those send me a text 2FAs and they say the code will expire in 30 seconds. And they take forever to come in.
That’s what it feels like waiting the text and it finally comes in.
“If you have a disability, simply use this alternative that’s even worse if you have a disability.”
Never seen that one ooof
The problem was those alternatives were even easier for AI, so they kept mutilating them until they’re practically unusable for anyone.
Like CAPTCHAs where the audio version sounds like those “satanic messages” you’d get by playing a record backwards.
wtf. no thank you
You should not be using SMS 2FAs anyways as they are very not secure (because of the SMS protocol).
Use TOTP whenever possible (the one where you use an app like Google Authenticator, but you typically should use other FOSS solutions)
Heh tell that to microslop. Every time you gotta log in to the college website. It feels so secure…
There are so many sites that force you to use the SMS 2FA, and I hate it!
For some logins I value so little i don’t even care to have a password on it, I really don’t give a shit if SMS isn’t secure.
this is like when you have to call a customer service phone line and they tell you to try the website
Your password is 30 days old. Make a new one. It can’t be the same as any of your last 37 passwords.
Mark, is that you?
