Yah the first time I saw it I was like wow so clever, but now I’m like why do you disrespect our purest form of online speech for your transactional babble
Yeah. Fuck those. I just now have this case, where I cannot login to a service I pay a subscription for. Contact support, wrote explicitly “I looked into the spam folder. I even looked into the logs of my mailserver, your mailserver does not even contact mine”.
Wait for two days, answer is (of course) “have you looked into your spam folder?”, nothing else. As soon as I manage to login, I cancel 😅 (jk, cancelled the payment already). Fuck those.
What other 2FA methods are you looking for? I have seen a couple sites that will call you, but that is really just verbal text messaging.
The stay logged on and trust this system actions are probably controlled by a browser cookie, so won’t work if you don’t allow cookies from that site.
a magic link is not 2FA if it doesn’t also require a password. it’s 1FA, they just replaced the one factor.
honestly i really hate websites that do that and yet don’t allow password-only 1FA. like sure, i understand that the average user’s password discipline is crap, but as a power user i’d really like it if all my accounts weren’t tied to all my other accounts sometimes.
The stay logged on and trust this system actions are probably controlled by a browser cookie, so won’t work if you don’t allow cookies from that site.
In my experience, they are. In my bowser, I have to explicitly allow the saving of site data if I hope to be able to keep myself logged in. For me, this is fine; I only want to stay logged in on a handful of sites anyway so the tradeoff between adding an exception for some sites vs. allowing every single site I visit to be able to save some piece of data doing god-knows-what (likely helping Facebook and the like track where it is I visit) on my machine is worth it.
even if you clear your cookies, the session token id still exists for the website
Some websites treat the first login you ever done as a sort of root of trust, for example for account recovery they might ask if you can to verify it is you on that session
Some websites use the number of login sessions and how many recent times you have logged in for theie hidden trust factor, and some may even lockdown your account if it gets too low automaticly
I don’t mind 2FA and Passkeys, they’re mostly fine. But I hate, hate, hate forced logins via magic links or 2FA by email or SMS.
Yah the first time I saw it I was like wow so clever, but now I’m like why do you disrespect our purest form of online speech for your transactional babble
Yeah. Fuck those. I just now have this case, where I cannot login to a service I pay a subscription for. Contact support, wrote explicitly “I looked into the spam folder. I even looked into the logs of my mailserver, your mailserver does not even contact mine”.
Wait for two days, answer is (of course) “have you looked into your spam folder?”, nothing else. As soon as I manage to login, I cancel 😅 (jk, cancelled the payment already). Fuck those.
What other 2FA methods are you looking for? I have seen a couple sites that will call you, but that is really just verbal text messaging.
The stay logged on and trust this system actions are probably controlled by a browser cookie, so won’t work if you don’t allow cookies from that site.
a magic link is not 2FA if it doesn’t also require a password. it’s 1FA, they just replaced the one factor.
honestly i really hate websites that do that and yet don’t allow password-only 1FA. like sure, i understand that the average user’s password discipline is crap, but as a power user i’d really like it if all my accounts weren’t tied to all my other accounts sometimes.
Timed One Time Passwords (TOTP). It’s what Google Authenticator and a lot of other 2FA apps use.
In my experience, they are. In my bowser, I have to explicitly allow the saving of site data if I hope to be able to keep myself logged in. For me, this is fine; I only want to stay logged in on a handful of sites anyway so the tradeoff between adding an exception for some sites vs. allowing every single site I visit to be able to save some piece of data doing god-knows-what (likely helping Facebook and the like track where it is I visit) on my machine is worth it.
2FA auth codes, like Ente Auth, or Okta.
even if you clear your cookies, the session token id still exists for the website
Some websites treat the first login you ever done as a sort of root of trust, for example for account recovery they might ask if you can to verify it is you on that session
Some websites use the number of login sessions and how many recent times you have logged in for theie hidden trust factor, and some may even lockdown your account if it gets too low automaticly
That’s so true, I want 2FA that runs once a week per device and password login.