Worst one I’ve seen: username and password plus a 2FA email, BUT if you hit enter instead of clicking the last button it refreshes the page.
Passkeys or oauthn/fido. I just can’t believe we’re still talking about passwords in 2025 when these very robust, user friendly features have been widely available for years.
FIDO alliance FTW!
The amount of security threat encouragement in these comments is impressive.
But if they don’t get an active email and/or phone number.
How can they then turn around and sell that to info brokers and spammers.
As an autistic person I felt this in my bones. I cannot STAND email based authentication.
There are a few reasons for this.
- Conversion rates are higher and the majority tend to prefer these over passwords
- When you have to reset a password, you typically have to send an email anyway.
- It’s technically safer because they are short lived tokens and if someone’s password gets compromised, their token cannot.
It’s not a perfect system by any means, but it’s better than the shit implementation of passkeys and it’s generally better than passwords for most users.
I prefer passwords over links and codes, but I get it.
- Conversion rates are higher and the majority tend to prefer these over passwords
can’t attest to this. I’ve seen so many users fail to understand they must click the link in their email to complete registration. some yet, still refuse and complain that “it could be spoofed”.
- When you have to reset a password, you typically have to send an email anyway.
not if you remember your password…
- It’s technically safer because they are short lived tokens and if someone’s password gets compromised, their token cannot.
except for the password on your email. this is just security through obscurity or security theater. just because you sent it as an email doesn’t make it more secure. it just makes it more complex.
And then…
The password manager can’t fill the form. You’ve got to change your 10-word passphrase because it’s 3 months old. And you have to verify with a text.
Oh and then you have to type it in on your TV with a remote and on-screen keyboard.
Also you better hope you used the password manager for this obscure app you don’t remember signing up with.
It used a different URL for sign in so isn’t picked up by the password manager.
The password is too strong doesn’t accept Ukraine letters.
Dose your granny have the a password manager. She should but would she understand how it works.
Password manager users living life on easy mode.
Very few things on the internet and computer actually need accounts. Everything requiring a login is a cancer.
Yes and no in most cases it is used to limit misuse somewhat but i absolutely agree that its taking over hand. God bless trashmails.
But you know what’s the safest way for us to keep your password safe? Not asking for one to begin with. By not creating a password with us you have no risk of it leaking, and we don’t have to deal with the responsibility of keeping it secure. The sign in link is going to your email, which presumably is protected with two-factor authentication, if you have it set up (which you should!).
https://www.404media.co/we-dont-want-your-password-3/
They had a follow up later too (paywall)
On the other end, there is an excessive use of 2FA with systems for whom the concept of SSO seems to be a foreign thing. It’s also sort of funny that 2FA can just mean using a TOTP capable password manager, reverting it back to one factor.
It’s not actually reduced to one factor, just a single point of failure. If their password manager gets taken it’s a problem, however the generated TOTP is worthless in 1 min. So this will protect the login from cases where the password is known like a compromised website or a reused password.
But if a password manager is compromised then doesn’t the attacker also get the TOTP key which is what generates the codes in the first place?
It wouldn’t matter if it expires in one minute because they’ll have the token to generate the next code, as well as now knowing the password.
That makes it a single point of failure yes, and the rest of the comment you’re replying to goes into detail on what it does protect from even if both passwd and TOTP are in the password manager
Sorry i misunderstood what you were saying. I thought you were saying that if the password manager was compromised then the attackers would have only 1 minute to make use of the tokens before they change.
If the site is compromised, then the hackers could have stolen the TOTP secrets as well as the passwords. How do you think the site verifies TOTP codes? If you reuse passwords while using a password manager, you are asking for it, though.
A full hack of every part of the service is not the only way a user’s password could get known to an attacker. Could be MiTM, could be typo-squatted, etc
If a site is that compromised no measure of auth is gonna help, so little use worrying about it.
This. This so much. Password+Totp based login is just two passwords where one is more annoying to use.
Not if your TOTP codes are generated by another device, then the attacker needs your password, plus the device holding the key for TOTP. If you use it on your phone and authenticator is your phone then a theif has everything when they steal your phone.
Hardware key for TOTP is a better 2FA method as its totally separate from your PC or phone
As long as the default recommendation is to use authenticator apps on your main device I’ll see this as a “could be good if implemented correctly, which it isn’t, so it isn’t good”
If you can get at a password by hacking a website, I wouldn’t be holding out hope that they couldn’t then steal the TOTP secret.
Magic link only is the wirst kind of login systems. However, I don’t know any big real companies that use this.
If you don’t like passwords, just use passkeys.Slack (except when with SSO). You have to go out of your way to find the settings page outside of the client to set a password.
Wasn’t passkeys basically “passwords, but Google has control of them”?
Not even close.
Passkey is a generic technology not specific to any vendor. While there are a few versions of it, the long story short is it uses an encryption key you have to authenticate you rather than a password. This makes phishing extremely difficult if not impossible.
There’s lots of passkey implementations. All the major browsers have one built in with their included password managers. Most good password managers like BitWarden or 1Password also support pass keys. And if you want to be extra secure, the passkey can be an actual hardware token like a YubiKey.
So yeah you see Google pushing passkeys a lot, and if you use Google password manager it will store your pass keys. But you also see Apple pushing it, and Microsoft also.
dont think so. what i gatherd passkeys is a public/private key scheme, much like pubkey auth in ssh logins.
Its still just a single factor if some body steals your private key.
Yes, buts it’s not something that can be easily guessed or found on a post it on the monitor
True dat. But if they compromise your computer the first thing the look for is key files.
Like my ssh keys are in a root permission file. Protected from general sight, but if somebody compromises my PC with a CVE on then goodbye keys.
At least with hardware key it is removable and requires a button press.
So accessing becomes physical access or quantum computer cracking
Its never transmitted, can be stored in HSMs. Anything that’s handled wrong is unsafe
Steals it from your system I meant. Which has even happened to security pros.
Booking.com (at least in Germany) only useagic links for some time now. I hate it.
Also, those stupid annoying modern log in pages where it just asks for your email, then refreshes to a page with a password, because the password managers are hit and miss on detecting the log in form when it does that shit and why the fuck are we doing an extra step oage anyway???
Passwords are quite insecure and people write them down on shit and forget them, I vastly prefer it too, but they’re going to die out, probably rather soon, so be prepared.
HEY BUT DO YOU WANT TO USE A PASSCODE?? PASSCODE! PASSCODE! USE THE PASSCODE! -_-
Yeah what the hell is up with that one? Seems so sketchy
Passkeys are okay, but your browser and OS want you to use them because you can’t just take a passkey to another platform, you have to create a new one, and it’s a pain in the ass.
It’s a lock-in gimmick latching on to a real useful solution.
Password managers can hold Passkeys now and they’re portable. Bitwarden stores all of mine, use them on any machine.
While true, it still means you’re locked into only being able to log in from a browser that has the password manager extension installed and logged in. Sometimes I want to log in from another machine, or another OS, or another browser, or even an incognito window that doesn’t have access to my extensions.
You can do that without an extension. There’s a bunch of different protocols that let you, for example, use your phone as the authenticator.
You can log in with your phone on a computer you’ve never used before by scanning a QR code and credentials never leave your device.
Yeh, I have passkeys in bitwarden.
I get it. Once they become ubiquitous, you click “login” your password manager prompts you to select account, and you are in.
No password that can be leaked, incorrectly stored, brute forced.
Corporations can pre-register company service passkeys for new users.
It’s like mTLS, except staged.
Ok that makes a lot of sense. It definitely seems like it’s more for them than it is for the user’s “convenience”
That’s false. My passkeys sync to my password manager and are available on all my devices
My passkeys are tied to my phone, which I use via the browser and OS. I keep them in my password manager running on the phone. My password manager supports the open spec for securely migrating credentials between vendors.
It may be difficult to believe but they want you to use them because they’re legitimately significantly better.
Users are silly. They blame Microsoft for bad passwords. They blame Google for forgotten passwords. They blame Facebook when they click on a phishing link. They blame apple when apple “lets” someone who they gave their password to see their pictures. They blame apple when they don’t let the user in just because they forgot their password and every recovery mechanism.
Everyone involved has a significant issue with passwords because they cost them user satisfaction, credibility, or money directly. The reason cross vendor transfer has been slow is because everyone wants to be the leader, since if everyone follows your lead you get to make it work better with your stuff.
Passkeys are fine. It’s just MTLS but by marketers (if by passcode you mean passkeys. otherwise, what’s a passcode?)
