• undree@lemmy.world
    22·
    2 hours ago

    I’m done offering users to use passwords. Makes the auth code so much simpler and defers the security to the user’s email or passkey storage.

  • ExLisper@lemmy.curiana.net
    11·
    5 hours ago

    Click ‘Sing in’ button -> takes you to registration page -> insert login and password -> tells you user already exists -> notice it’s the wrong form -> click on ‘already have an account’ below…

    Saw this more than once. How the fuck does anyone implement it like that?

  • Tenderizer@aussie.zoneEnglish
    2·
    6 hours ago

    That’s not logins nowadays, that’s just Microsoft Teams.

    And seriously what is with Microsoft and logins. How have they screwed the bed so bad. I used to have an outlook email but when I tried to set up 2FA some unknown error kept occurring. And when I tried to set up a passkey for Microsoft Teams (just so it STOPS ASKING ME), same thing happens.

  • baltakatei@sopuli.xyz
    5·
    16 hours ago

    It is not being fixed because the people that decide whether it needs fixing or not are so wealthy that they have dedicated servants to take care of that drudgery. You’re an NPC that is a programmable cog in their passive cash flow generator, not a person.

  • unphazed@lemmy.world
    6·
    22 hours ago

    My job uses a Yubikey, authenticator, and more than 6 passwords, one of which for some damn reason at random points in a day thinks I’m on a seperate machine and forces me to get a verification code in my email. On top of that, one password resets every 3mo, another at 3 weeks, and the others are like every 8mo. All remember past passwords, will not allow any variation or similarity (you had a twelve char password with a number at the end in 2021, try another). It is a damn struggle creating a new password 12 years in now.

  • kungfuratte@feddit.org
    74·
    1 day ago

    I don’t mind 2FA and Passkeys, they’re mostly fine. But I hate, hate, hate forced logins via magic links or 2FA by email or SMS.

    • anewfox@lemmy.zip
      3·
      23 hours ago

      2fa over email is light years better than 2fa over sms for a whole slew of security reasons.

    • kossa@feddit.org
      171·
      1 day ago

      Yeah. Fuck those. I just now have this case, where I cannot login to a service I pay a subscription for. Contact support, wrote explicitly “I looked into the spam folder. I even looked into the logs of my mailserver, your mailserver does not even contact mine”.

      Wait for two days, answer is (of course) “have you looked into your spam folder?”, nothing else. As soon as I manage to login, I cancel 😅 (jk, cancelled the payment already). Fuck those.

    • mad_lentil@lemmy.caEnglish
      7·
      1 day ago

      Yah the first time I saw it I was like wow so clever, but now I’m like why do you disrespect our purest form of online speech for your transactional babble

    • Simulation6@sopuli.xyz
      1·
      1 day ago

      What other 2FA methods are you looking for? I have seen a couple sites that will call you, but that is really just verbal text messaging.
      The stay logged on and trust this system actions are probably controlled by a browser cookie, so won’t work if you don’t allow cookies from that site.

      • b3nsn0w@lemmy.world
        4·
        1 day ago

        a magic link is not 2FA if it doesn’t also require a password. it’s 1FA, they just replaced the one factor.

        honestly i really hate websites that do that and yet don’t allow password-only 1FA. like sure, i understand that the average user’s password discipline is crap, but as a power user i’d really like it if all my accounts weren’t tied to all my other accounts sometimes.

      • furry toaster@lemmy.blahaj.zoneEnglish
        2·
        1 day ago

        even if you clear your cookies, the session token id still exists for the website

        Some websites treat the first login you ever done as a sort of root of trust, for example for account recovery they might ask if you can to verify it is you on that session

        Some websites use the number of login sessions and how many recent times you have logged in for theie hidden trust factor, and some may even lockdown your account if it gets too low automaticly

        • anewfox@lemmy.zip
          3·
          23 hours ago

          everyone knows to clear their cookies but absolutely nobody thinks to clear their localStorage, sessionStorage, or indexedDB. i have never once in my life seen someone include those when telling someone else to “clear their cookies.” even including cache in that list (e.g. using ctrl+shift+r to refresh the page instead of ctrl+r) is weirdly uncommon.

      • MapleFantastic5738@lemmy.ca
        1·
        1 day ago

        The stay logged on and trust this system actions are probably controlled by a browser cookie, so won’t work if you don’t allow cookies from that site.

        In my experience, they are. In my bowser, I have to explicitly allow the saving of site data if I hope to be able to keep myself logged in. For me, this is fine; I only want to stay logged in on a handful of sites anyway so the tradeoff between adding an exception for some sites vs. allowing every single site I visit to be able to save some piece of data doing god-knows-what (likely helping Facebook and the like track where it is I visit) on my machine is worth it.