Bad link won’t autofill though because it’s the wrong url
There are plenty of ways.
DNS poisoning with one of those #4 private keys would be the easiest.
Getting Grandma to add a trusted CA would be another.
Paste bombs into browser terminals.
Something you have is a very important part of keeping people out of your stuff.
Once they are at the level where they break HTTPS, they can also ask you for the 2FA code or passkey and intercept that through their services, and you’d be hacked anyway.
Passkeys don’t work like that. They would, in fact, stop that from happening.
That is of course if the company didn’t let you choose another method
You forgot the “click to verify you are human” (followed by a dumb captcha, maybe 10) just after you click login but before logging in, which makes you, after you pass the captcha, click again to login.
Nah fucking email code every time! Just let me use ausernsme and password fucking god damned it. I don’t want my email involved in this process!
Your password is 30 days old. Make a new one. It can’t be the same as any of your last 37 passwords.
I don’t care about 2FA and Passkeys, they’re mostly fine. But I hate, hate, hate forced logins via magic links or 2FA by email or SMS.
Yah the first time I saw it I was like wow so clever, but now I’m like why do you disrespect our purest form of online speech for your transactional babble
What other 2FA methods are you looking for? I have seen a couple sites that will call you, but that is really just verbal text messaging.
The stay logged on and trust this system actions are probably controlled by a browser cookie, so won’t work if you don’t allow cookies from that site.That’s so true, I want 2FA that runs once a week per device and password login.
Yeah. Fuck those. I just now have this case, where I cannot login to a service I pay a subscription for. Contact support, wrote explicitly “I looked into the spam folder. I even looked into the logs of my mailserver, your mailserver does not even contact mine”.
Wait for two days, answer is (of course) “have you looked into your spam folder?”, nothing else. As soon as I manage to login, I cancel 😅 (jk, cancelled the payment already). Fuck those.
The best bit is you go through all this drama and then some bloke finds a web form someone forgot to disable and gets access to everyone’s account with one click anyway.
or social exploit the company’s IT, or a wordpress plugin, an AD vulnerability
Do yOu tRUsT tHiS maChiNe?
“No, but I’ll click yes this time because I know what you meant better than you do”
I hate passkeys. Fuck off with your passkeys. I will stop using Amazon because it won’t stop trying to add a passkey into my bitwarden
What’s wrong with passkeys? my preferred method. Hell I wish everything just used those and no email password shit
There’s a lot of other better reasons to stop using amazon, but if that’s the one for you, it’s still a victory if you stop using them.
Also… sends code to email account, which requires another round of login hoops.
Don’t forget, if you type in one of your other email addresses by mistake it says something like “sending you a magic link”.
Then it acts like you are signing in, but you are signing up, on a new account, oops, fuckers, just tell me it’s not a valid account.
Not recognized by password manager for some fucking reason
usually it’s because it’s either an extension interfering or the website declared username/password field with non-consecutive tab index, or the app doesn’t even support tabbing into password field at all
Or the password manager “typing” the password, but it doesn’t fill the box and then the manager dares to say “done!!” even tho it has not done it. Again and again, until you give up and manually add the password in.
That’s the second text on the bottom :)
I love those send me a text 2FAs and they say the code will expire in 30 seconds. And they take forever to come in.
That’s what it feels like waiting the text and it finally comes in.
You should not be using SMS 2FAs anyways as they are very not secure (because of the SMS protocol).
Use TOTP whenever possible (the one where you use an app like Google Authenticator, but you typically should use other FOSS solutions)
this is like when you have to call a customer service phone line and they tell you to try the website
There are so many sites that force you to use the SMS 2FA, and I hate it!
For some logins I value so little i don’t even care to have a password on it, I really don’t give a shit if SMS isn’t secure.
Microsoft’s is even worse.
- Enter username
- Enter password
- Click “stay logged in”
- Click “log in”
- Login successful!
- Page reloads to the username prompt
- Repeat steps 1-6. Sometimes (but rarely) repeat them multiple times.
- Now you’re actually logged in.
How hard is it to log in the user if the username and password were correct? If Microsoft can not figure out how to do this, why do other random websites work? Do those websites have some arcane knowledge being held away from Microsoft?
Microsoft Login is genuinely one of the worst designed piece of software I have ever seen. It takes actual skill to login lol.
… I was using 1password to store my passkey(s). On Thursday, it failed to login to Microsoft for work.
“Your passkey is valid, but didn’t meet the criteria set by your administrators.”
Screw this, I’m going back to passwords. At least I decide where/how to store this.
I thought the last one was just my computer being glitchy. So what’s the deal with that?
Do you clear your cookies often? Or have any fingerprinting mitigation turned on? (I’m just throwing ideas out here, I’m not an expert on this stuff)
Fuck if I know. Cross site stuff probably.
You guys don’t just reset your password every time you log in to something you don’t use daily? They’ll never get my password if even I can’t remember it, moving target!
