Logging in shouldn’t feel like passing an exam. Just let us access our accounts!
Don’t forget to accept the cookies [YES] [no]
Finally bout up sign in ~ "iS tHis YoU???!!? [yes][no] "
I don’t mind 2FA and Passkeys, they’re mostly fine. But I hate, hate, hate forced logins via magic links or 2FA by email or SMS.
Yah the first time I saw it I was like wow so clever, but now I’m like why do you disrespect our purest form of online speech for your transactional babble
What other 2FA methods are you looking for? I have seen a couple sites that will call you, but that is really just verbal text messaging.
The stay logged on and trust this system actions are probably controlled by a browser cookie, so won’t work if you don’t allow cookies from that site.Timed One Time Passwords (TOTP). It’s what Google Authenticator and a lot of other 2FA apps use.
2FA auth codes, like Ente Auth, or Okta.
even if you clear your cookies, the session token id still exists for the website
Some websites treat the first login you ever done as a sort of root of trust, for example for account recovery they might ask if you can to verify it is you on that session
Some websites use the number of login sessions and how many recent times you have logged in for theie hidden trust factor, and some may even lockdown your account if it gets too low automaticly
Yeah. Fuck those. I just now have this case, where I cannot login to a service I pay a subscription for. Contact support, wrote explicitly “I looked into the spam folder. I even looked into the logs of my mailserver, your mailserver does not even contact mine”.
Wait for two days, answer is (of course) “have you looked into your spam folder?”, nothing else. As soon as I manage to login, I cancel 😅 (jk, cancelled the payment already). Fuck those.
That’s so true, I want 2FA that runs once a week per device and password login.
The best bit is you go through all this drama and then some bloke finds a web form someone forgot to disable and gets access to everyone’s account with one click anyway.
or social exploit the company’s IT, or a wordpress plugin, an AD vulnerability
You forgot the “click to verify you are human” (followed by a dumb captcha, maybe 10) just after you click login but before logging in, which makes you, after you pass the captcha, click again to login.
Bad link won’t autofill though because it’s the wrong url
That’s when you go to your password app and click autofill yourself.
There are plenty of ways.
DNS poisoning with one of those #4 private keys would be the easiest.
Getting Grandma to add a trusted CA would be another.
Paste bombs into browser terminals.
Something you have is a very important part of keeping people out of your stuff.
Once they are at the level where they break HTTPS, they can also ask you for the 2FA code or passkey and intercept that through their services, and you’d be hacked anyway.
Passkeys don’t work like that. They would, in fact, stop that from happening.
That is of course if the company didn’t let you choose another method
I didn’t test it (of course), but I think they do for this case.
So we have a man in the middle attack, that proxies traffic to a website through it and just decrypts it without changing it during the login. This is similar to what cloudflare does. The browser has no way to know somebody is spying: HTTPS cerificate is ok(stolen cert), the domain matches the expected(dns poisoning), even the page is exactly the same, so it performs the passkey challenge/response. The only thing that changed is the certificate, which is not suspicious (certificates can change normally!).
The attacker is not able to clone the passkey, but they are able though to steal your session cookies after the login. Instead of giving you the “login success page” they keep you waiting on a loading page while they navigate (with a script) with your stolen session cookies to the “add passkey” page of the site to add theirs.
If the website asks them again for the passkey as confirmation, instead of serving the “login successful page”, they serve the new 2FA prompt to you. You are left wondering “Didn’t I just do the 2FA? What a buggy site!”. And unknowingly approve adding the attacker’s passkey.
Game over, account fully compromised.
We are lucky that HTTPs is very good for security, they revoke certificates very quickly if this happens, and browsers check the certificate transparency logs making it impossible to forge a new certificate, even if you got hold of a root certificate with private key “4”. This attack also needs unrealistic level of compromise: stolen and unrevoked certificate + a poisoned DNS. Completely unrealistic scenario, but it’s not passkeys that saved you, it was HTTPS.
When they say passkeys are unphisheable they mean you can’t usually copy them and give them to an attacker, but an attacker can absolutely still add theirs to your account.
I wasn’t aware they dropped WebAuthN, it was RIGHT THERE… but you’re right.
it’s still a lot easier to get someone to 2FA over the phone and tell them their password manager is flakey, but I def concede
Damn, that’s awful news
Your password is 30 days old. Make a new one. It can’t be the same as any of your last 37 passwords.
Mark, is that you?
I love those send me a text 2FAs and they say the code will expire in 30 seconds. And they take forever to come in.
That’s what it feels like waiting the text and it finally comes in.
You should not be using SMS 2FAs anyways as they are very not secure (because of the SMS protocol).
Use TOTP whenever possible (the one where you use an app like Google Authenticator, but you typically should use other FOSS solutions)
There are so many sites that force you to use the SMS 2FA, and I hate it!
For some logins I value so little i don’t even care to have a password on it, I really don’t give a shit if SMS isn’t secure.
this is like when you have to call a customer service phone line and they tell you to try the website
Nah fucking email code every time! Just let me use ausernsme and password fucking god damned it. I don’t want my email involved in this process!
Microsoft’s is even worse.
- Enter username
- Enter password
- Click “stay logged in”
- Click “log in”
- Login successful!
- Page reloads to the username prompt
- Repeat steps 1-6. Sometimes (but rarely) repeat them multiple times.
- Now you’re actually logged in.
How hard is it to log in the user if the username and password were correct? If Microsoft can not figure out how to do this, why do other random websites work? Do those websites have some arcane knowledge being held away from Microsoft?
Microsoft seem to have integrated XBox Live and microsoft.com (and others, like Minecraft) just enough that they all depend on each other, but not enough to know WTF is going on. Trying to get anything working seems to involve logging into everything and messing with similar but ineffective settings. And, each login to each system does the Azure URL dance.
Watching the url bar when logging into MS Azure is quite the ride. It redirects one billion times.
Microsoft Login is genuinely one of the worst designed piece of software I have ever seen. It takes actual skill to login lol.
Microsoft oauth login in a browser: type in password, get pop-up “reusing passwords is a security risk. Change password now?”.
I sure wonder why the password to my AD account is the same as the password to my windows account. It’s almost like they’re the exact same account or something.
… I was using 1password to store my passkey(s). On Thursday, it failed to login to Microsoft for work.
“Your passkey is valid, but didn’t meet the criteria set by your administrators.”
Screw this, I’m going back to passwords. At least I decide where/how to store this.
Do yOu tRUsT tHiS maChiNe?
“No, but I’ll click yes this time because I know what you meant better than you do”
Don’t forget, if you type in one of your other email addresses by mistake it says something like “sending you a magic link”.
Then it acts like you are signing in, but you are signing up, on a new account, oops, fuckers, just tell me it’s not a valid account.
By the way, having two accounts is not allowed, so we banned both accounts for violating EULA.
I hate passkeys. Fuck off with your passkeys. I will stop using Amazon because it won’t stop trying to add a passkey into my bitwarden
There’s a lot of other better reasons to stop using amazon, but if that’s the one for you, it’s still a victory if you stop using them.
What’s wrong with passkeys? my preferred method. Hell I wish everything just used those and no email password shit
Try losing your phone and see how easy is to recover from that, or having to explain to your grandma how they lost their accounts everywhere because they didn’t have a backup strategy for passkeys, even though they remember the password for the account (!).
There’s also the very big issue of attestation, where websites can force users to use a specific password manager, which doesn’t allow you to move the key to a fully free solution. This was made for companies to force the users to use real hardware tokens or only approved authenticator apps, but nothing prevents google to start forcing you to use only google authenticator to login to google, or for apple to own an iphone to login to a site. Usually all big-company passwors managers don’t have any way to export the key, and you have to wonder why.
This attestation threat is very real: here is somebody that AFAIK was part of the w3c committee that made passkeys threatening to use attestation against keepassxc for allowing the user to export keys: https://github.com/keepassxreboot/keepassxc/issues/10407
Overall, it feels like yet another complicated technology, that also allows big companies to consolidate power.
Every conclusion you just made is wildly incorrect, or at the very least misleading or misunderstood.
Try losing your phone and see how easy is to recover from that, or having to explain to your grandma how they lost their accounts everywhere because they didn’t have a backup strategy for passkeys, even though they remember the password for the account (!).
If you lose your Amazon passkey, you can switch back to another 2FA method. Same for Google, and honestly, every other place I have a passkey in play. Adding a passkey doesn’t delete your password or other 2FA.
Losing your phone usually doesn’t lose your passkeys anyway. Apple, Google, 1Password, and Bitwarden sync them, so they come back when you sign in on a new device.
There’s also the very big issue of attestation, where websites can force users to use a specific password manager, which doesn’t allow you to move the key to a fully free solution. This was made for companies to force the users to use real hardware tokens or only approved authenticator apps, but nothing prevents google to start forcing you to use only google authenticator to login to google, or for apple to own an iphone to login to a site.
Apple’s and Google’s synced passkeys provide no attestation, so a website can’t cryptographically tell which password manager made them.
A site can read the provider ID (AAGUID), but without attestation it’s self-reported and can be faked, so in the wild it’s useless as a way to block people. It’d be no different from Google requiring you to use Chrome, which they could already do today, but don’t.
Enforced provider restrictions do exist, but only in controlled enterprise setups with hardware keys or managed authenticators, like Entra ID allowlists.
Also, to note: Google Authenticator is a TOTP app. It’s not where Google stores passkeys.
Usually all big-company passwors managers don’t have any way to export the key, and you have to wonder why.
Out of date. Apple added passkey export/import in iOS/macOS 26, and Google added it to Google Password Manager in June 2026. Microsoft is the holdout: it can import but not export yet. Bitwarden also lets the end user export passkeys. The industry standard is built to move passkeys app-to-app, not as plaintext files that could be exfiltrated.
This attestation threat is very real: here is somebody that AFAIK was part of the w3c committee that made passkeys threatening to use attestation against keepassxc for allowing the user to export keys: https://github.com/keepassxreboot/keepassxc/issues/10407
He asked the KeePassXC project to “put basic protections in place and collaborate with the ecosystem/industry,” and said attestation would allow RPs (websites) to block it. The pressure was real, but it was a warning about plaintext export, not a plan to lock people in. A plaintext passkey file can be grabbed by malware or talked out of someone by a scammer, which is why the industry built an app-to-app transfer standard instead.
Not recognized by password manager for some fucking reason
usually it’s because it’s either an extension interfering or the website declared username/password field with non-consecutive tab index, or the app doesn’t even support tabbing into password field at all
That’s the second text on the bottom :)
Or the password manager “typing” the password, but it doesn’t fill the box and then the manager dares to say “done!!” even tho it has not done it. Again and again, until you give up and manually add the password in.
