Programmer Humor

The best I've seen was yesterday where a website had the log-in button greyed out after the password manager filled my creds in.
So I had to manually click both the email and password field. Just click them. Then it enabled the log-in button.
So someone took their time to write a piece of JS that said "If the user hasn't focused both fields at least once, no login". Literally why? Extra code that does nothing useful.

I was hoping passkeys would be the solution to this madness, but it seems to me the entire spec gives too much power to the OS Makers and too little to the users because "mUh AtTtEsTatIoN" so now I don't know anymore

God I hate those stupid magic links. They're WAAAAYYY slower than just using my password manager.

AND they kinda contribute to locking you into Big Tech. I sometimes have problems with those stupid links because I don't have a Gmail account. Somewhere along the stupid chain there's probably some stupid check that delays or blackholes emails to non-big-tech domains.

Or worse:

Use email link -> use password instead

Enter password

Now enter the code that we sent you your email...

Also This strange trend to split username and password on to two separate pages, or only showing the password field after confirming the username

HEY BUT DO YOU WANT TO USE A PASSCODE?? PASSCODE! PASSCODE! USE THE PASSCODE! -_-

It feels like the factors of authentication discussion misses one important aspect: can the factor be replayed. Passwords can be replayed indefinitely, while the email links you get or the OTP token only work for a short period of time.

I remember it from the bad days when I used LastPass. Suddenly I got a notification that the place had been compromised and I had to suddenly change hundreds of passwords. 90% of them were for sites that didn't even exist any longer, but sifting through the long, long list to go change passwords was more work than I wanted to do.

Don't have to do that if I need to use a one-time token via Aegis or email! I do agree, though, that for low risk sites, username/password is totally fine.

Ah but you see it's one factor of authentication that also conveniently loops in whichever email provider is spying on you

Just let me use passkeys at this point. The way that people typically use passwords is less secure anyway, why not just make it as simple as possible?

The amount of security threat encouragement in these comments is impressive.

My email uses greylisting which is where the first email received from a server gets a "busy" response - the idea being that spammers just fire and forget whereas real mailers will retry.

Unfortunately, some senders take so long to resend that it's timed out. The second time will work though. Unless they have multiple servers. Some have so many servers that you have to do this a multitude of times until you lose the will to login or forget what you were going to do anyway.

I can imagine that the sites want to validate that you still have access to the email associated with the account, and asking people to check their settings is annoying, and they know no one will do it. I can also imagine that sites want to know as much about you as possible, don't want you to be using burner email addresses, and are probably selling the fact that your email address can still receive email to marketing firms who compile that info.

Passwords are quite insecure and people write them down on shit and forget them, I vastly prefer it too, but they're going to die out, probably rather soon, so be prepared.

Hearing this in Spongebob's voice is amazing!

I weirdly don't mind the email method. I don't like copy pasting my passwords because I feel it's less secure than typing it out.

Now I wouldn't mind if it was an option.