Or even an account for that matter
You must log in or register to comment.
I would rather have 2fa than the magic link email bullshit. I am so fucking tired of sites assuming I don’t want to use a simple username and password, and I clearly want to have to wait on email delivery to be able to access my account instead of JUST ENTERING MY GODS DAMNED CREDENTIALS.
IMO anything hooked up to your financial info should have 2FA
also not everything needs email
just username + password is enough usually
Data collection is normalized and people will come up with ““reasonable”” arguments if the practice is challenged.
What really grinds my gears is when they require a password as well.
Why did you require a password when your going to bug me about 2fa anyways? Why did you require me to change said password every 3 months if you bug me about 2fa anyways? Why are you asking me to switch my password with your dumb restrictions (no special characters, really BofA?) when it has been recommended for years to not require users to do that since it just makes the passwords less unique in the long term?
2fa is fine, just remove passwords if your going to do it.
It’s not a second factor if you remove passwords, the password is the first factor.
otherwise yes absolutely, password recycling should be dropped as soon as 2fa is implemented.
That’s what bugs me about passwordless. It’s just 1fa again, except that the password is still there to sign in from other devices if you don’t have a passkey set up yet, so now you have more than one attack vector.
Passkeys and Totp codes in my password manager make no fucking sense to me. And whoever is pushing passkeys as the new default needs to get a hard slap in the face, they’ve clearly never dealt with end users or my mom.
This, but specifically because of Microsoft Authenticator. I hate this app so damn much. [I’m forced to use it] not with TOTP tokens, but push-notification based ones which arrive only sometimes and are slow. And then it’s mocking me saying “pull to refresh if you don’t see a notification”, but there is no pull to refresh feature. Oh and Microsoft Azure Portal? It asks you to authenticate twice in a row, just to be sure. Burn burn burn
I tried MS Authenticator after creating a business account with me as the admin, and it let me enroll and then immediately gave me a device untrusted error (I’m rooted, sue me, but there’s no warning or way to tell that’s not allowed) which then login-looped every recovery option to try to re-enroll or remove the 2FA, requiring me to file a ticket and manually prove who I am which took 48-hours.
Just the fact that they let me sign up before pulling the rug and revoking access with a hidden, time-bomb fail condition, really impressed me. It takes work to be that evil.
That sounds horrible. I hate that steam requires me to use their app instead of the authenticator app I use for everything else but at least it works every time
I feel this. And the endless fucking prompt to log in. Several times a day. Everywhere. We should bill Microsoft for the time lost.
I had a really fun one with my Google account the other day. It was the one where you had to select the number it was showing on “the other screen”. However it was trying to show it on my same phone I was trying to log in on, only to immediately overwrite it with the prompt to select the correct number. Cue me sitting there having to guess the right number like 6 times before finally getting access, getting logged back out every time I failed to guess right
If it’s not something you can get it back by demanding it in real life you shouldn’t put 2FA on it. A bank account will be given back for that reason. Accounts online are unrecoverable that way. Lemmy’s 2FA was so bad that many people lost their accounts using it.
I had one the other day. Enter passcode from Auth app. Ok done. Great. We just emailed you another code enter that now.
Passkeys plz
No thanks. I’m fine with passwords for most things, and MFA of my choosing for important things.
Things that I have 2FA for for some reason:
- my abandoned Ubisoft account which holds two free games and doesn’t have any personal details about me
Things I don’t have 2FA for, although I’d probably prefer if I could have:
- my bank account
2fa for a ubisoft account is actually very important. what if somebody hacks into ur account and buys more ubisoft games???
No, you see banks don’t need 2fa because they’ve got ironclad password requirements like “max of 8 characters, alphanumeric only”.
But some of them don’t tell you that when you first set it, so you have to call tech support and, after sending you a temporary password to log in and set a new password which then also doesn’t work, they’re like “wait, you can’t have & or ! in the password — try it without,” and it works because it accepted the password but removed all special characters without telling you 🙃
Your bank lets you use letters? Mine just numbers. The registration allowed 10 numbers but the login does not allowed more than 8… At least they block the account after 3 incorrect guess and make you ask for a reset in person. So I had to go twice in a day… and the teller lady asked why I don’t use 4 digits like a normal person… Sill beter than the other bank which sends the password back in plain text email after registration in 2019
My bank allows alphanumeric passwords, but only 5 characters
I sometimes wonder how their opsec specialists cope…
My bank doesn’t allow copy+paste into the new password fields, and clears anything you’ve typed if you switch apps.
To set a new password (which is mandatory every 6mo) I have to physically write down the new password that my password manager generates…
