The worst way of login:
Login with Google
Login with Facebook
Login with GitHubFollowed by the login that doesn’t let you use a password but sends you a mail with a link instead. Straight from hell.
Even worse. They automatically create an account if you don’t already have one through the login mechanism, so you get multiple accounts that can’t be merged.
Even worse:
Page 1: enter email or phone number
Page 2: enter password
Page 3: enter 2FA
okay, but why the fuck am I entering a password if you’re forcing me to use 2FA?
Corposluts: “iTs MoRe SeCuRe”
BITCH - If I can fucking reset my password with the same email/phone number I use to receive my 2FA, then the password is functionally useless
“Stay signed in”, the biggest lie
Blame the credential stuffers, and then the people that reuse the same stupid password and not bother to use a password manager.
I really hate when the login button is hard to find relative to the sign up button. It should be the other way around; you only sign up once, but you log in many times. It should be optimized for the more frequent task.
To me it’s always felt like a pretty blatant way to say they don’t give a shit about their existing users.
please install an app in your phone which only works once in the phone you installed it first and make your life a hell the moment you change it.
2FA is a good thing. You don’t want it to go away.
Almost all sites should allow me to choose whether I want 2fac. And they shouldn’t prompt for it nearly as often as they do - some services do it for every login, most seem to do it every month at least.
I get the theory, but if it itself relies on some login-based service (like email) it becomes a kind of chicken and egg problem.
I don’t want it for like 95% of the logins I have.
Seriously. Why would i care if someone logs into most of them. What are they going to do watch a movie on my Netflix account, play my kids roblox games, or change my crew on my Rockstar account? It’s unnecessary bs.
Any account that does payment (like your netflix one), will be used to test out stolen credit cards. This will in turn flag your account for fraud. You might not want that. Unless you do, I don’t know
What? Like they’d try and use a stolen credit card to pay for my service?
They won’t be paying, just tokenizing the cards to see if the data is good.
Click login button -> Autofill username, password & totp token -> Done
(And staying signed in not working is an intentional side effect of deleting cookies and temp data on closing the browser…)
For 2FA: Find a good password manager. They can also handle TOTP (the algorithm most 2FA implementations use), so you just autofill user & password, then autofill the TOTP, done. I use KeePassXC + sync the DB, but there are plenty of other trustworthy password managers. Plus, if you get in the habit of generating secure passwords using the password manager, one leaked login doesn’t cost you all of them.
The second you put totp codes into bitwarden, it’s no longer mfa.
Also, it can still be MFA which is the way I use it.
This is what I do. It’s fine for me. I know how to do this more safely than the average person by far.
I do it to, bit it’s not mfa at that point because you have a single point of failure/compromise
Google doesn’t care that your account got stolen, the IT department does
“I understand that your username and password are correct, but I just won’t let you log in right now. No, I couldn’t have told you this before you tried to.”
Why are you hating on passkeys? They are awesome! So much more convenient than passwords.
I don’t like Passkey because it’s an overly complicated system, and because it places too much power in entities that I do not trust and I do not want to depend on.
I can’t use Passkey because it lacks support for some of the systems that I use.
It’s fine that it exists, but sadly, some online services have made it mandatory, thereby locking me out of my accounts.
Making it mandatory is incredibly stupid.
I think the main probem for now is bad third party implementation… several password managers work with passkeys, too, but they all have problems with interoperability, sometimes even with backing them up inside the program.
This is my answer—passkeys suck. Maybe in another decade they’ll be usable.
tbh if you actually use passkeys the entire hassle is gone
Nnnnnnnnnnnope. Not even close.
Well, it is for me. I can sign in with one click, can’t get better than that.
