Programmer Humor

This. This so much. Totp based login is just two passwords where one is more annoying to use.

And when they do they only offer them as the second factor.

Yes, let me first input my password (from a password manager), the let me approve with a passkey that is meant to make my password not necessary.

But email based login: FUCK THAT SHIT.

What are they?

Not if it comes to hardware-based passkeys I would argue

It's not perfect but will break many bot logins and people trying different logins from data leaks.

I've definitely run into that. Even more frustrating is when there was one particular site that forced me to actually delete the last character of my password and then retype it. Just focusing in the field wasn't enough, I had to actually send it a keystroke. And Ctrl-V to paste the password in manually didn't count. I suppose typing a random character at the end and then deleting it would have worked too.

Oh, it gets worse. I've had some where I have to enter a character into the boxes before it would figure its shit out...

My utitlies website doesn't let you login if the password field is autofilled by the browser. Whatever Angular-based form validation they are using doesn't play nice with Firefox's saved password feature. You have to manually type something in the password field, so I always add and remove a space from the password.

I sent an email to their support, hoping they would fix it, but they just responded saying that they can't reproduce it.

Well, I can reproduce it. I even told you how. That sounds like a skill issue.

They inevitably didn't write it for that reason. They wrote it to say the field is invalid until the user changes it to be valid after someone landed on the page holding the enter key down and instantly locked themselves out after submitting the form 50 times in 3 seconds.
Unless you know otherwise, it's easy to think that "form interaction" is the same as "form changed", and one of those is much easier to check.

I'm unsure what you mean about passkeys. I don't think I've heard anyone mention significant concessions to os makers and I'm pretty tuned in on the topic.

That ones because users like choice. They need to look up who you are to know how you've chosen to authenticate. At least, that's how it started. Some could be doing it because the big kids are, but that's why the big kids do.
And they support choice because businesses want to use their login infrastructure and refuse to share. So you enter "user@businessOrUniversity.com.edu" and it forwards you to your institutional login.

Not that strange. Different users may belong to different groups which may have different authentication backends. The associated authentication method is brought up once a username has been provided.

1. Username
2. Password
3. MFA
4. Do the whole process all over again because the remember this device is on step 2 and it's impossible to go back

Bonus stage 0: special login URL decided to crap out, and going back to any point in history automatically redirects to the error page that you can't use to log in, so you need to keep going back and trying to copy the URL before it redirects becausw Firefox interprets pressing "stop" as "do whatever you want idk"

Fucking aws...

Came here to say that! For the love of God, stop with this nonsense!

And the auto-submitting TOTP entry form where you're apparently not allowed to make a typo. And obscuring the TOTP number like it's a password or state secret.

2 factor authentication, only when you feel like it.

They might as well be piping the password to /dev/null

Website wants you to make a passkey, go to login but the entry form only accepts the user name, then you have to click next to password which may or may not accept the passkey.

Is that FIDO? What's the difference?

If they arent on a USB stick, protected against being copied, they are only a single factor that instill false safety.

Based.

Email is terrible. It's an unreliable communication system. You cannot depend on sent emails arriving in the recipient's mailbox—even the spam folder.

People incorrectly assume that all emails at least get to their spam folder. They don't. There are multiple levels of filters that prevent most emails from ever making it that far because most email traffic is bots blasting phishing links, scams, and spam. Nobody wants phishing and scam emails, but the blocks that prevent those are being used by big tech to justify discriminating against small mail servers.

I can't remember the site, now, but I literally couldn't log into one this week because the email never arrived.

Every hardware based key I ever used also required PIN, but as far as expense and backups, yes, for personal use the cost generally may not be justified. I got all my personal ones as a bundle that was on sale. For work I would argue that some businesses can easily justify the cost to create a rotating stock of hardware keys to deal with lost keys. Generally in that environment you have centralized PKI, where you can revoke the certificate on the lost key and then issue a new certificate on a new hardware key. This doesn't help for all sign in methods tied to hardware keys, but can be very practical when implemented right.

I also agree on TOTP as the ultimate generic 2FA method, with several worsening options until the despised email or sms 2FA. I will also add that you can setup TOTP on modern hardware keys, where you must insert and complete PIN entry. The inconvenience is that you must have all your keys and password manager available at setup time for places that don't support multiple TOTP codes.

What password manager doesn’t support passkeys these days?