Logging in is a 17 button process these days.
Why does this meme presume a log in is even necessary!!
My job uses a Yubikey, authenticator, and more than 6 passwords, one of which for some damn reason at random points in a day thinks I’m on a seperate machine and forces me to get a verification code in my email. On top of that, one password resets every 3mo, another at 3 weeks, and the others are like every 8mo. All remember past passwords, will not allow any variation or similarity (you had a twelve char password with a number at the end in 2021, try another). It is a damn struggle creating a new password 12 years in now.
I just paid all of my bills and had to login to each account. Once a month torture session lol.
i just have my bank do that.
I don’t like to automate it because I get paid every other week and it falls on different days. I just pay my bills first thing when I get paid so I know for sure it’s paid and didn’t bounce
I got a new phone and tried using the Merlin birding app but now I need to enter an email, receive an email, confirm using the link in the email…
…and then enter the user name and password I’ve been using to log into the app for years.
And it’s not just once but every time I use the app, it’s a nightmare, and I don’t want to give any extra information I don’t have to.
Don’t forget to accept the cookies [YES] [no]
Except you accept cookies in X browser, but not Y browser because that is an emulated system to run a 30yr old program they never bothered to update because it worked great on x86 machines but was never designed for 64 bit.
Website Title [Sign Up] ~[log in]~
Logging in shouldn’t feel like passing an exam. Just let us access our accounts!
if ousing 2fa code is “like passing an exam,” maybe the internet is too hard for you.
bot
I don’t mind 2FA and Passkeys, they’re mostly fine. But I hate, hate, hate forced logins via magic links or 2FA by email or SMS.
2fa over email is light years better than 2fa over sms for a whole slew of security reasons.
Yeah. Fuck those. I just now have this case, where I cannot login to a service I pay a subscription for. Contact support, wrote explicitly “I looked into the spam folder. I even looked into the logs of my mailserver, your mailserver does not even contact mine”.
Wait for two days, answer is (of course) “have you looked into your spam folder?”, nothing else. As soon as I manage to login, I cancel 😅 (jk, cancelled the payment already). Fuck those.
Yah the first time I saw it I was like wow so clever, but now I’m like why do you disrespect our purest form of online speech for your transactional babble
That’s so true, I want 2FA that runs once a week per device and password login.
What other 2FA methods are you looking for? I have seen a couple sites that will call you, but that is really just verbal text messaging.
The stay logged on and trust this system actions are probably controlled by a browser cookie, so won’t work if you don’t allow cookies from that site.a magic link is not 2FA if it doesn’t also require a password. it’s 1FA, they just replaced the one factor.
honestly i really hate websites that do that and yet don’t allow password-only 1FA. like sure, i understand that the average user’s password discipline is crap, but as a power user i’d really like it if all my accounts weren’t tied to all my other accounts sometimes.
Timed One Time Passwords (TOTP). It’s what Google Authenticator and a lot of other 2FA apps use.
2FA auth codes, like Ente Auth, or Okta.
The stay logged on and trust this system actions are probably controlled by a browser cookie, so won’t work if you don’t allow cookies from that site.
In my experience, they are. In my bowser, I have to explicitly allow the saving of site data if I hope to be able to keep myself logged in. For me, this is fine; I only want to stay logged in on a handful of sites anyway so the tradeoff between adding an exception for some sites vs. allowing every single site I visit to be able to save some piece of data doing god-knows-what (likely helping Facebook and the like track where it is I visit) on my machine is worth it.
even if you clear your cookies, the session token id still exists for the website
Some websites treat the first login you ever done as a sort of root of trust, for example for account recovery they might ask if you can to verify it is you on that session
Some websites use the number of login sessions and how many recent times you have logged in for theie hidden trust factor, and some may even lockdown your account if it gets too low automaticly
everyone knows to clear their cookies but absolutely nobody thinks to clear their localStorage, sessionStorage, or indexedDB. i have never once in my life seen someone include those when telling someone else to “clear their cookies.” even including cache in that list (e.g. using ctrl+shift+r to refresh the page instead of ctrl+r) is weirdly uncommon.
Finally bout up sign in ~ "iS tHis YoU???!!? [yes][no] "
The best bit is you go through all this drama and then some bloke finds a web form someone forgot to disable and gets access to everyone’s account with one click anyway.
or social exploit the company’s IT, or a wordpress plugin, an AD vulnerability
Your password is 30 days old. Make a new one. It can’t be the same as any of your last 37 passwords.
Mark, is that you?
I love those send me a text 2FAs and they say the code will expire in 30 seconds. And they take forever to come in.
That’s what it feels like waiting the text and it finally comes in.
You should not be using SMS 2FAs anyways as they are very not secure (because of the SMS protocol).
Use TOTP whenever possible (the one where you use an app like Google Authenticator, but you typically should use other FOSS solutions)
Heh tell that to microslop. Every time you gotta log in to the college website. It feels so secure…
For some logins I value so little i don’t even care to have a password on it, I really don’t give a shit if SMS isn’t secure.
this is like when you have to call a customer service phone line and they tell you to try the website
Microsoft’s is even worse.
- Enter username
- Enter password
- Click “stay logged in”
- Click “log in”
- Login successful!
- Page reloads to the username prompt
- Repeat steps 1-6. Sometimes (but rarely) repeat them multiple times.
- Now you’re actually logged in.
How hard is it to log in the user if the username and password were correct? If Microsoft can not figure out how to do this, why do other random websites work? Do those websites have some arcane knowledge being held away from Microsoft?
Watching the url bar when logging into MS Azure is quite the ride. It redirects one billion times.
Microsoft Login is genuinely one of the worst designed piece of software I have ever seen. It takes actual skill to login lol.
Microsoft oauth login in a browser: type in password, get pop-up “reusing passwords is a security risk. Change password now?”.
I sure wonder why the password to my AD account is the same as the password to my windows account. It’s almost like they’re the exact same account or something.
Microsoft seem to have integrated XBox Live and microsoft.com (and others, like Minecraft) just enough that they all depend on each other, but not enough to know WTF is going on. Trying to get anything working seems to involve logging into everything and messing with similar but ineffective settings. And, each login to each system does the Azure URL dance.
… I was using 1password to store my passkey(s). On Thursday, it failed to login to Microsoft for work.
“Your passkey is valid, but didn’t meet the criteria set by your administrators.”
Screw this, I’m going back to passwords. At least I decide where/how to store this.
You forgot the “click to verify you are human” (followed by a dumb captcha, maybe 10) just after you click login but before logging in, which makes you, after you pass the captcha, click again to login.
Don’t forget, if you type in one of your other email addresses by mistake it says something like “sending you a magic link”.
Then it acts like you are signing in, but you are signing up, on a new account, oops, fuckers, just tell me it’s not a valid account.
Telling the user that the account doesn’t exist is bad practice. Hackers can use it to find out who has an account on what platform and more directly target them with phishing emails
Ok, use the classic “bad username or password”.
Or just properly rate limit so hackers can’t just slam the long in page with a zillion combos.
By the way, having two accounts is not allowed, so we banned both accounts for violating EULA.
