Even worse:
Page 1: enter email or phone number
Page 2: enter password
Page 3: enter 2FA
okay, but why the fuck am I entering a password if you’re forcing me to use 2FA?
Corposluts: “iTs MoRe SeCuRe”
BITCH - If I can fucking reset my password with the same email/phone number I use to receive my 2FA, then the password is functionally useless
The worst way of login:
Login with Google
Login with Facebook
Login with GitHubFollowed by the login that doesn’t let you use a password but sends you a mail with a link instead. Straight from hell.
Even worse. They automatically create an account if you don’t already have one through the login mechanism, so you get multiple accounts that can’t be merged.
“Stay signed in”, the biggest lie
I hate that my entire job at the moment is looking after those fucking login/registration flows. It’s NEVER simple, it’s always “Oh we want this in the flow too, and this, and this, and we want all these alternate flows but we want to be anonymous when we log in so we’re logged in, but as nobody, oh and we want to be able to log in as like 10 different emails all at the same time, and also if I sign into one identity provider and then sign into a different one, it should know that and sign me into the new one automatically. Third party cookies? I’m not talking about biscuits!”.
There’s so much bullshit I’ve had to staple onto our existing system just to make the login process even more complicated for business analysts that don’t know what they want.
Blame the credential stuffers, and then the people that reuse the same stupid password and not bother to use a password manager.
Well that’s a very stupid thing to do.
You should blame people that maliciously steal passwords or otherwise access accounts they shouldn’t be. You should be blaming the criminals not random people just trying to log into their email.
You should also blame enshitification for the broader prompt fatigue we deal with that makes things like “Add a passkey? :D” prompts feel so tiring.
I really hate when the login button is hard to find relative to the sign up button. It should be the other way around; you only sign up once, but you log in many times. It should be optimized for the more frequent task.
Users unfamiliar with the interface should get the big button.
word, friendica used to be like this and I kept getting messages like “this user already exists” half the time I was trying to log in.
To me it’s always felt like a pretty blatant way to say they don’t give a shit about their existing users.
What i want:
Click login button
Cryptographic exchange happens
Done
2FA is a good thing. You don’t want it to go away.
Except when it’s just an email, or worse, a txt message, or worse, a whatsapp message, with no other option for using a proper 2fa generator…
But also, not every site needs 2fa, sometimes I really couldn’t care less if someone managed to hack into something, because I can just make a new account if that happened…
What really bugs me is that TOTP is objectively easier than any other form of 2fa. Just import the library, add the field on your login form, and you’re done.
- Email verification is annoying to code, it requires SMTP or an email gateway, is slow for the user, is risky from a security perspective, and to generate the code you probably still have to implement TOTP.
- SMS/RCS is even more annoying to code, it almost inevitably requires a third-party gateway, it can work differently if the user is in a different country or on a MVNO or in a low-signal area or just has the wrong astrological sign, is very slow for the end user, is almost useless from a security perspective, and you STILL have to implement TOTP.
- WhatsApp messages are somehow even more annoying to code than that, requires an api interaction with Meta (which is never fun and poorly documented), requires the end user to have an account with a specific third party, is slow for the end user, relies on another company’s security posture to determine your own, and you STILL have to implement TOTP.
- Making your own app for 2fa is undoubtedly the worst: not only is it annoying to code, it’s an ongoing annoyance that is strained through multiple app stores, adds an additional maintenance and support load, adds additional technical debt, adds an unnecessary attack vector, requires users to download another app, is often unreliable, is often pretty slow for the end user, is a total crapshoot from a security perspective, and guess what? YOU PROBABLY STILL HAVE TO IMPLEMENT TOTP.
Any company that chooses SMS or email verification over TOTP emphatically does not know what they’re doing.
2fa by email is probably slightly easier than TOTP, if the account verification via email is already implemented, but yeah, it’s not like it’s significantly easier…
That is a fair point. But again, you probably have to implement TOTP or something like it anyway, to generate the code.
You don’t have to implement totp for these alternatives… The “thing” about totp is that there’s a shared secret and a timestamp. Due to potential drift in clocks you need a window and period to know how many time steps to test, and how long each is.
But with an email/SMS/WhatsApp, there’s no shared secret. So you can simply send a random code, and store server side when it was generated. Totp makes no sense in that case.
Not that totp is difficult to implement at all. My implementation for work was what, less than 200 lines of C++ I think? I didn’t implement the sha1 myself though.
Almost all sites should allow me to choose whether I want 2fac. And they shouldn’t prompt for it nearly as often as they do - some services do it for every login, most seem to do it every month at least.
I don’t think the 2FA is the issue this comic is attempting to convey.
Except that it needs another jump for autofill 2fa
I don’t want it for like 95% of the logins I have.
Seriously. Why would i care if someone logs into most of them. What are they going to do watch a movie on my Netflix account, play my kids roblox games, or change my crew on my Rockstar account? It’s unnecessary bs.
Any account that does payment (like your netflix one), will be used to test out stolen credit cards. This will in turn flag your account for fraud. You might not want that. Unless you do, I don’t know
What? Like they’d try and use a stolen credit card to pay for my service?
They won’t be paying, just tokenizing the cards to see if the data is good.
The bigger issue is gaining account details and personal info for identity theft.
I don’t care. Likelihood is that’s not going to actually cause me anything but an annoyance anyway, so the cost of preventing it can’t be more annoying
Which also doesn’t matter anymore because companies sell our data all the time or just give it away through their own data insecurities. Or yanno, white pages. com and similar exists and its pretty easy to find anything about anyone anytime.
I get the theory, but if it itself relies on some login-based service (like email) it becomes a kind of chicken and egg problem.
yes I do. I will take convivence over security most days. Just because you don’t, and you have good reasons to want it to stay, doesn’t mean everyone comes to the same conclusion based on similar data.
Good thing you aren’t in charge of anything, then.
Although I personally think 2FA is very important in most cases, I agree that mandatory 2FA is annoying. If you want to forego security for convenience, that should be up to you. I’m sure you’re not stupid or ignorant of the risks.
As a user its annoying, as a developer it is incredibly frustrating and time consuming.
It fails for somebody every day, it adds a dependency for a known unreliable 3rd party that often mangles the identification data it sends back, it is exploited by that 3rd party for extending their monopoly, and it gives that 3rd party (or any hacker that got access to them) full access to impersonate any user it wants.
What?
Implement TOTP and let your users use their preferred authenticator and none of what you’re struggling with will apply.
Which also means you can just copy/paste it alongside username and password with the same manager.
👆️
This is uterly idiotic but ok. I have decided I do not need to wear seat belt in the car. Just because you do and you have good reasons to want it to stay, doesn’t mean everyone comes to the same conclusion based on similar data.
there, now you are getting it.
i dont want you not wearing the seatbelt, it is so easy to do
we live in a society and im tired of paying for stupid doing stupid things
The day my taxes go towards paying for people who don’t have 2fa, we can discuss whether it should be mandatory. Also, comparing a compromised Netflix account to loss of life, really?
comparing cost to society
there is a reason ms forces updates now
Click login button -> Autofill username, password & totp token -> Done
(And staying signed in not working is an intentional side effect of deleting cookies and temp data on closing the browser…)
please install an app in your phone which only works once in the phone you installed it first and make your life a hell the moment you change it.
Tell me about passkeys.
What’s this supposed to mean?
Yubikey. It’s basically a passkey but locked onto a physical chip
Oh hell yes, that way if I lose it I can’t log into anything!!
Unless you also register a backup key and carefully store recovery codes whenever a service provides them!
Oh hell yes that sounds simple! Maybe we could call these codes “passwords” and call the service a “password manager”. Maybe we could even implement some kind of browser thing to automatically input these in webpages for more convenience.
YubiKey, one of the many examples of loging in via keys
For 2FA: Find a good password manager. They can also handle TOTP (the algorithm most 2FA implementations use), so you just autofill user & password, then autofill the TOTP, done. I use KeePassXC + sync the DB, but there are plenty of other trustworthy password managers. Plus, if you get in the habit of generating secure passwords using the password manager, one leaked login doesn’t cost you all of them.
The second you put totp codes into bitwarden, it’s no longer mfa.
Also, it can still be MFA which is the way I use it.
What they’re saying is that if all of the multiple factors are stored behind 1 master password in 1 service, the whole purpose of MFA is negated. You’ve just shifted the single point of failure from a website password to your Bitwarden master password.
True, but to access bitwarden you need a device already logged in to bitwqrden or the TOTP for bitwarden, so effectively overly 2FA.
Also, the purpose of a password manager is unique secure passwords, so most users start off more secure.
You’re not wrong at all that it’s still more secure than most. But it’s still not mfa in that case unless you have separate mfa to get into Bitwarden/LastPass/etc, THEN you could make an argument that it’s mfa by proxy.
This is what I do. It’s fine for me. I know how to do this more safely than the average person by far.
I do it to, bit it’s not mfa at that point because you have a single point of failure/compromise
Google doesn’t care that your account got stolen, the IT department does
“I understand that your username and password are correct, but I just won’t let you log in right now. No, I couldn’t have told you this before you tried to.”
Why are you hating on passkeys? They are awesome! So much more convenient than passwords.
I don’t like Passkey because it’s an overly complicated system, and because it places too much power in entities that I do not trust and I do not want to depend on.
I can’t use Passkey because it lacks support for some of the systems that I use.
It’s fine that it exists, but sadly, some online services have made it mandatory, thereby locking me out of my accounts.
Making it mandatory is incredibly stupid.
I think the main probem for now is bad third party implementation… several password managers work with passkeys, too, but they all have problems with interoperability, sometimes even with backing them up inside the program.
This is my answer—passkeys suck. Maybe in another decade they’ll be usable.
tbh if you actually use passkeys the entire hassle is gone
I can only speak for myself, but I often can’t find where I put my device that the passkey is on.
ah, I use a password manager, so it’s always in hand
Nnnnnnnnnnnope. Not even close.
Well, it is for me. I can sign in with one click, can’t get better than that.
