Find login button hidden on signup page
This one makes me irrationally angry
no, it’s rational
It has the same energy as insurance companies or ISPs that only offer good deals to new customers.
I just paid all of my bills and had to login to each account. Once a month torture session lol.
i just have my bank do that.
Logging in shouldn’t feel like passing an exam. Just let us access our accounts!
bot
Don’t forget to accept the cookies [YES] [no]
Don’t not deny allowing access to remove access to cookies!
Finally bout up sign in ~ "iS tHis YoU???!!? [yes][no] "
I don’t mind 2FA and Passkeys, they’re mostly fine. But I hate, hate, hate forced logins via magic links or 2FA by email or SMS.
Yah the first time I saw it I was like wow so clever, but now I’m like why do you disrespect our purest form of online speech for your transactional babble
Yeah. Fuck those. I just now have this case, where I cannot login to a service I pay a subscription for. Contact support, wrote explicitly “I looked into the spam folder. I even looked into the logs of my mailserver, your mailserver does not even contact mine”.
Wait for two days, answer is (of course) “have you looked into your spam folder?”, nothing else. As soon as I manage to login, I cancel 😅 (jk, cancelled the payment already). Fuck those.
What other 2FA methods are you looking for? I have seen a couple sites that will call you, but that is really just verbal text messaging.
The stay logged on and trust this system actions are probably controlled by a browser cookie, so won’t work if you don’t allow cookies from that site.a magic link is not 2FA if it doesn’t also require a password. it’s 1FA, they just replaced the one factor.
honestly i really hate websites that do that and yet don’t allow password-only 1FA. like sure, i understand that the average user’s password discipline is crap, but as a power user i’d really like it if all my accounts weren’t tied to all my other accounts sometimes.
Timed One Time Passwords (TOTP). It’s what Google Authenticator and a lot of other 2FA apps use.
The stay logged on and trust this system actions are probably controlled by a browser cookie, so won’t work if you don’t allow cookies from that site.
In my experience, they are. In my bowser, I have to explicitly allow the saving of site data if I hope to be able to keep myself logged in. For me, this is fine; I only want to stay logged in on a handful of sites anyway so the tradeoff between adding an exception for some sites vs. allowing every single site I visit to be able to save some piece of data doing god-knows-what (likely helping Facebook and the like track where it is I visit) on my machine is worth it.
2FA auth codes, like Ente Auth, or Okta.
even if you clear your cookies, the session token id still exists for the website
Some websites treat the first login you ever done as a sort of root of trust, for example for account recovery they might ask if you can to verify it is you on that session
Some websites use the number of login sessions and how many recent times you have logged in for theie hidden trust factor, and some may even lockdown your account if it gets too low automaticly
That’s so true, I want 2FA that runs once a week per device and password login.
The best bit is you go through all this drama and then some bloke finds a web form someone forgot to disable and gets access to everyone’s account with one click anyway.
or social exploit the company’s IT, or a wordpress plugin, an AD vulnerability
Autofill will typically check the URL of the site, byte for byte.
I wonder if the hacker will accept the whole Bee movie script as a password…
Now you made me wonder if the bee movie script is in a rainbow table somewhere
Bad link won’t autofill though because it’s the wrong url
There are plenty of ways.
DNS poisoning with one of those #4 private keys would be the easiest.
Getting Grandma to add a trusted CA would be another.
Paste bombs into browser terminals.
Something you have is a very important part of keeping people out of your stuff.
Paste bombs into browser terminals.
Some time ago I was browsing less credible part of the internet and got a Cloudflare pop-up asking me to check the captcha tick box. So I did. Then it asked me to verify the check by pasting a command into powershell. Wonder how many people fell for that one
Once they are at the level where they break HTTPS, they can also ask you for the 2FA code or passkey and intercept that through their services, and you’d be hacked anyway.
Passkeys don’t work like that. They would, in fact, stop that from happening.
That is of course if the company didn’t let you choose another method
I didn’t test it (of course), but I think they do for this case.
So we have a man in the middle attack, that proxies traffic to a website through it and just decrypts it without changing it during the login. This is similar to what cloudflare does. The browser has no way to know somebody is spying: HTTPS cerificate is ok(stolen cert), the domain matches the expected(dns poisoning), even the page is exactly the same, so it performs the passkey challenge/response. The only thing that changed is the certificate, which is not suspicious (certificates can change normally!).
The attacker is not able to clone the passkey, but they are able though to steal your session cookies after the login. Instead of giving you the “login success page” they keep you waiting on a loading page while they navigate (with a script) with your stolen session cookies to the “add passkey” page of the site to add theirs.
If the website asks them again for the passkey as confirmation, instead of serving the “login successful page”, they serve the new 2FA prompt to you. You are left wondering “Didn’t I just do the 2FA? What a buggy site!”. And unknowingly approve adding the attacker’s passkey.
Game over, account fully compromised.
We are lucky that HTTPs is very good for security, they revoke certificates very quickly if this happens, and browsers check the certificate transparency logs making it impossible to forge a new certificate, even if you got hold of a root certificate with private key “4”. This attack also needs unrealistic level of compromise: stolen and unrevoked certificate + a poisoned DNS. Completely unrealistic scenario, but it’s not passkeys that saved you, it was HTTPS.
When they say passkeys are unphisheable they mean you can’t usually copy them and give them to an attacker, but an attacker can absolutely still add theirs to your account.
That’s tickling a part of my recollection, but I could be crossing wires.
I could have sworn webauthn had a component where the server also signed a challenge for proof of possession of their key.
There’s also the component where the server can assert that the device is of a certain type, from a certain providence, in a way that’s a lot harder to fake. Anyone worth their salt would also notice that the users IP address had gone very weird, and in fact all the addresses for every customer had gone weird and identical (automatically, since no one’s checking that obviously).
You’re still fundamentally correct, but it’s worth underscoring how massively you’d have needed to own their infrastructure for the passkeys to be compromised. :)
I wasn’t aware they dropped WebAuthN, it was RIGHT THERE… but you’re right.
it’s still a lot easier to get someone to 2FA over the phone and tell them their password manager is flakey, but I def concede
Damn, that’s awful news
That’s when you go to your password app and click autofill yourself.
Your password is 30 days old. Make a new one. It can’t be the same as any of your last 37 passwords.
Mark, is that you?
I love those send me a text 2FAs and they say the code will expire in 30 seconds. And they take forever to come in.
That’s what it feels like waiting the text and it finally comes in.
“If you have a disability, simply use this alternative that’s even worse if you have a disability.”
Never seen that one ooof
You should not be using SMS 2FAs anyways as they are very not secure (because of the SMS protocol).
Use TOTP whenever possible (the one where you use an app like Google Authenticator, but you typically should use other FOSS solutions)
Heh tell that to microslop. Every time you gotta log in to the college website. It feels so secure…
There are so many sites that force you to use the SMS 2FA, and I hate it!
For some logins I value so little i don’t even care to have a password on it, I really don’t give a shit if SMS isn’t secure.
this is like when you have to call a customer service phone line and they tell you to try the website
You forgot the “click to verify you are human” (followed by a dumb captcha, maybe 10) just after you click login but before logging in, which makes you, after you pass the captcha, click again to login.
Microsoft’s is even worse.
- Enter username
- Enter password
- Click “stay logged in”
- Click “log in”
- Login successful!
- Page reloads to the username prompt
- Repeat steps 1-6. Sometimes (but rarely) repeat them multiple times.
- Now you’re actually logged in.
How hard is it to log in the user if the username and password were correct? If Microsoft can not figure out how to do this, why do other random websites work? Do those websites have some arcane knowledge being held away from Microsoft?
Watching the url bar when logging into MS Azure is quite the ride. It redirects one billion times.
Microsoft Login is genuinely one of the worst designed piece of software I have ever seen. It takes actual skill to login lol.
Microsoft oauth login in a browser: type in password, get pop-up “reusing passwords is a security risk. Change password now?”.
I sure wonder why the password to my AD account is the same as the password to my windows account. It’s almost like they’re the exact same account or something.
Microsoft seem to have integrated XBox Live and microsoft.com (and others, like Minecraft) just enough that they all depend on each other, but not enough to know WTF is going on. Trying to get anything working seems to involve logging into everything and messing with similar but ineffective settings. And, each login to each system does the Azure URL dance.
… I was using 1password to store my passkey(s). On Thursday, it failed to login to Microsoft for work.
“Your passkey is valid, but didn’t meet the criteria set by your administrators.”
Screw this, I’m going back to passwords. At least I decide where/how to store this.
Don’t forget, if you type in one of your other email addresses by mistake it says something like “sending you a magic link”.
Then it acts like you are signing in, but you are signing up, on a new account, oops, fuckers, just tell me it’s not a valid account.
Telling the user that the account doesn’t exist is bad practice. Hackers can use it to find out who has an account on what platform and more directly target them with phishing emails
Ok, use the classic “bad username or password”.
Or just properly rate limit so hackers can’t just slam the long in page with a zillion combos.
By the way, having two accounts is not allowed, so we banned both accounts for violating EULA.
Do yOu tRUsT tHiS maChiNe?
“No, but I’ll click yes this time because I know what you meant better than you do”
Nah fucking email code every time! Just let me use ausernsme and password fucking god damned it. I don’t want my email involved in this process!
But if they don’t constantly verify that your using that email, the spam that they send you later would be worthless
