Click ‘Sing in’ button -> takes you to registration page -> insert login and password -> tells you user already exists -> notice it’s the wrong form -> click on ‘already have an account’ below…
Saw this more than once. How the fuck does anyone implement it like that?
If you just create a passkey, it’s exactly like the top one
That’s not logins nowadays, that’s just Microsoft Teams.
And seriously what is with Microsoft and logins. How have they screwed the bed so bad. I used to have an outlook email but when I tried to set up 2FA some unknown error kept occurring. And when I tried to set up a passkey for Microsoft Teams (just so it STOPS ASKING ME), same thing happens.
website login is fine. app login rejects same login/pass. fml
It is not being fixed because the people that decide whether it needs fixing or not are so wealthy that they have dedicated servants to take care of that drudgery. You’re an NPC that is a programmable cog in their passive cash flow generator, not a person.
Find login button hidden on signup page
This one makes me irrationally angry
no, it’s rational
It has the same energy as insurance companies or ISPs that only offer good deals to new customers.
Click login button -> Use your passkey -> Done
Logging in is a 17 button process these days.
I just paid all of my bills and had to login to each account. Once a month torture session lol.
i just have my bank do that.
I don’t like to automate it because I get paid every other week and it falls on different days. I just pay my bills first thing when I get paid so I know for sure it’s paid and didn’t bounce
I don’t mind 2FA and Passkeys, they’re mostly fine. But I hate, hate, hate forced logins via magic links or 2FA by email or SMS.
2fa over email is light years better than 2fa over sms for a whole slew of security reasons.
That’s correct (at least most of the time), but it’s still terribly inconvenient.
Yeah. Fuck those. I just now have this case, where I cannot login to a service I pay a subscription for. Contact support, wrote explicitly “I looked into the spam folder. I even looked into the logs of my mailserver, your mailserver does not even contact mine”.
Wait for two days, answer is (of course) “have you looked into your spam folder?”, nothing else. As soon as I manage to login, I cancel 😅 (jk, cancelled the payment already). Fuck those.
Yah the first time I saw it I was like wow so clever, but now I’m like why do you disrespect our purest form of online speech for your transactional babble
That’s so true, I want 2FA that runs once a week per device and password login.
What other 2FA methods are you looking for? I have seen a couple sites that will call you, but that is really just verbal text messaging.
The stay logged on and trust this system actions are probably controlled by a browser cookie, so won’t work if you don’t allow cookies from that site.Timed One Time Passwords (TOTP). It’s what Google Authenticator and a lot of other 2FA apps use.
a magic link is not 2FA if it doesn’t also require a password. it’s 1FA, they just replaced the one factor.
honestly i really hate websites that do that and yet don’t allow password-only 1FA. like sure, i understand that the average user’s password discipline is crap, but as a power user i’d really like it if all my accounts weren’t tied to all my other accounts sometimes.
2FA auth codes, like Ente Auth, or Okta.
even if you clear your cookies, the session token id still exists for the website
Some websites treat the first login you ever done as a sort of root of trust, for example for account recovery they might ask if you can to verify it is you on that session
Some websites use the number of login sessions and how many recent times you have logged in for theie hidden trust factor, and some may even lockdown your account if it gets too low automaticly
everyone knows to clear their cookies but absolutely nobody thinks to clear their localStorage, sessionStorage, or indexedDB. i have never once in my life seen someone include those when telling someone else to “clear their cookies.” even including cache in that list (e.g. using ctrl+shift+r to refresh the page instead of ctrl+r) is weirdly uncommon.
The stay logged on and trust this system actions are probably controlled by a browser cookie, so won’t work if you don’t allow cookies from that site.
In my experience, they are. In my bowser, I have to explicitly allow the saving of site data if I hope to be able to keep myself logged in. For me, this is fine; I only want to stay logged in on a handful of sites anyway so the tradeoff between adding an exception for some sites vs. allowing every single site I visit to be able to save some piece of data doing god-knows-what (likely helping Facebook and the like track where it is I visit) on my machine is worth it.
Don’t forget to accept the cookies [YES] [no]
Don’t not deny allowing access to remove access to cookies!
Website Title [Sign Up] ~[log in]~
Except you accept cookies in X browser, but not Y browser because that is an emulated system to run a 30yr old program they never bothered to update because it worked great on x86 machines but was never designed for 64 bit.
My job uses a Yubikey, authenticator, and more than 6 passwords, one of which for some damn reason at random points in a day thinks I’m on a seperate machine and forces me to get a verification code in my email. On top of that, one password resets every 3mo, another at 3 weeks, and the others are like every 8mo. All remember past passwords, will not allow any variation or similarity (you had a twelve char password with a number at the end in 2021, try another). It is a damn struggle creating a new password 12 years in now.
Are you allowed to use a password manager, like 1password or Bitwarden? I juggle with docens of passwords per client, all with different expiration dates and complexity rules. A password manager is the only reason I can get them all straight. A good password manager should let you save your passwords, passkeys, recovery codes and MFA codes all in one app locked with a single password + MFA
How much time do you spend on that per week?
Finally bout up sign in ~ "iS tHis YoU???!!? [yes][no] "
Logging in shouldn’t feel like passing an exam. Just let us access our accounts!
bot
Okay wtf is up with accounts like these? What is the incentive to make a shitty comment bot on lemmy? I don’t get it
Security is important, no doubt. I just think logging in should be secure without making the whole process unnecessarily complicated.
if ousing 2fa code is “like passing an exam,” maybe the internet is too hard for you.
Not all 2fa methods are created equal. “Shit … where did I put my RSA fob?”
And yes: I know there’s an app. The day my employer gives me a phone I might switch to it.
I love those send me a text 2FAs and they say the code will expire in 30 seconds. And they take forever to come in.
That’s what it feels like waiting the text and it finally comes in.
“If you have a disability, simply use this alternative that’s even worse if you have a disability.”
Never seen that one ooof
The problem was those alternatives were even easier for AI, so they kept mutilating them until they’re practically unusable for anyone.
Like CAPTCHAs where the audio version sounds like those “satanic messages” you’d get by playing a record backwards.
wtf. no thank you
You should not be using SMS 2FAs anyways as they are very not secure (because of the SMS protocol).
Use TOTP whenever possible (the one where you use an app like Google Authenticator, but you typically should use other FOSS solutions)
Heh tell that to microslop. Every time you gotta log in to the college website. It feels so secure…
There are so many sites that force you to use the SMS 2FA, and I hate it!
For some logins I value so little i don’t even care to have a password on it, I really don’t give a shit if SMS isn’t secure.
this is like when you have to call a customer service phone line and they tell you to try the website
