Why does this meme presume a log in is even necessary!!
My job uses a Yubikey, authenticator, and more than 6 passwords, one of which for some damn reason at random points in a day thinks I’m on a seperate machine and forces me to get a verification code in my email. On top of that, one password resets every 3mo, another at 3 weeks, and the others are like every 8mo. All remember past passwords, will not allow any variation or similarity (you had a twelve char password with a number at the end in 2021, try another). It is a damn struggle creating a new password 12 years in now.
Find login button hidden on signup page
This one makes me irrationally angry
no, it’s rational
It has the same energy as insurance companies or ISPs that only offer good deals to new customers.
I just paid all of my bills and had to login to each account. Once a month torture session lol.
i just have my bank do that.
Logging in shouldn’t feel like passing an exam. Just let us access our accounts!
if ousing 2fa code is “like passing an exam,” maybe the internet is too hard for you.
bot
Don’t forget to accept the cookies [YES] [no]
Except you accept cookies in X browser, but not Y browser because that is an emulated system to run a 30yr old program they never bothered to update because it worked great on x86 machines but was never designed for 64 bit.
Don’t not deny allowing access to remove access to cookies!
Finally bout up sign in ~ "iS tHis YoU???!!? [yes][no] "
Autofill will typically check the URL of the site, byte for byte.
I wonder if the hacker will accept the whole Bee movie script as a password…
Now you made me wonder if the bee movie script is in a rainbow table somewhere
Bad link won’t autofill though because it’s the wrong url
That’s when you go to your password app and click autofill yourself.
There are plenty of ways.
DNS poisoning with one of those #4 private keys would be the easiest.
Getting Grandma to add a trusted CA would be another.
Paste bombs into browser terminals.
Something you have is a very important part of keeping people out of your stuff.
Once they are at the level where they break HTTPS, they can also ask you for the 2FA code or passkey and intercept that through their services, and you’d be hacked anyway.
Passkeys don’t work like that. They would, in fact, stop that from happening.
That is of course if the company didn’t let you choose another method
I didn’t test it (of course), but I think they do for this case.
So we have a man in the middle attack, that proxies traffic to a website through it and just decrypts it without changing it during the login. This is similar to what cloudflare does. The browser has no way to know somebody is spying: HTTPS cerificate is ok(stolen cert), the domain matches the expected(dns poisoning), even the page is exactly the same, so it performs the passkey challenge/response. The only thing that changed is the certificate, which is not suspicious (certificates can change normally!).
The attacker is not able to clone the passkey, but they are able though to steal your session cookies after the login. Instead of giving you the “login success page” they keep you waiting on a loading page while they navigate (with a script) with your stolen session cookies to the “add passkey” page of the site to add theirs.
If the website asks them again for the passkey as confirmation, instead of serving the “login successful page”, they serve the new 2FA prompt to you. You are left wondering “Didn’t I just do the 2FA? What a buggy site!”. And unknowingly approve adding the attacker’s passkey.
Game over, account fully compromised.
We are lucky that HTTPs is very good for security, they revoke certificates very quickly if this happens, and browsers check the certificate transparency logs making it impossible to forge a new certificate, even if you got hold of a root certificate with private key “4”. This attack also needs unrealistic level of compromise: stolen and unrevoked certificate + a poisoned DNS. Completely unrealistic scenario, but it’s not passkeys that saved you, it was HTTPS.
When they say passkeys are unphisheable they mean you can’t usually copy them and give them to an attacker, but an attacker can absolutely still add theirs to your account.
You forgot the “click to verify you are human” (followed by a dumb captcha, maybe 10) just after you click login but before logging in, which makes you, after you pass the captcha, click again to login.
Nah fucking email code every time! Just let me use ausernsme and password fucking god damned it. I don’t want my email involved in this process!
Your password is 30 days old. Make a new one. It can’t be the same as any of your last 37 passwords.
Mark, is that you?
I don’t care about 2FA and Passkeys, they’re mostly fine. But I hate, hate, hate forced logins via magic links or 2FA by email or SMS.
2fa over email is light years better than 2fa over sms for a whole slew of security reasons.
Yah the first time I saw it I was like wow so clever, but now I’m like why do you disrespect our purest form of online speech for your transactional babble
What other 2FA methods are you looking for? I have seen a couple sites that will call you, but that is really just verbal text messaging.
The stay logged on and trust this system actions are probably controlled by a browser cookie, so won’t work if you don’t allow cookies from that site.a magic link is not 2FA if it doesn’t also require a password. it’s 1FA, they just replaced the one factor.
honestly i really hate websites that do that and yet don’t allow password-only 1FA. like sure, i understand that the average user’s password discipline is crap, but as a power user i’d really like it if all my accounts weren’t tied to all my other accounts sometimes.
Timed One Time Passwords (TOTP). It’s what Google Authenticator and a lot of other 2FA apps use.
2FA auth codes, like Ente Auth, or Okta.
even if you clear your cookies, the session token id still exists for the website
Some websites treat the first login you ever done as a sort of root of trust, for example for account recovery they might ask if you can to verify it is you on that session
Some websites use the number of login sessions and how many recent times you have logged in for theie hidden trust factor, and some may even lockdown your account if it gets too low automaticly
everyone knows to clear their cookies but absolutely nobody thinks to clear their localStorage, sessionStorage, or indexedDB. i have never once in my life seen someone include those when telling someone else to “clear their cookies.” even including cache in that list (e.g. using ctrl+shift+r to refresh the page instead of ctrl+r) is weirdly uncommon.
That’s so true, I want 2FA that runs once a week per device and password login.
Yeah. Fuck those. I just now have this case, where I cannot login to a service I pay a subscription for. Contact support, wrote explicitly “I looked into the spam folder. I even looked into the logs of my mailserver, your mailserver does not even contact mine”.
Wait for two days, answer is (of course) “have you looked into your spam folder?”, nothing else. As soon as I manage to login, I cancel 😅 (jk, cancelled the payment already). Fuck those.
The best bit is you go through all this drama and then some bloke finds a web form someone forgot to disable and gets access to everyone’s account with one click anyway.
or social exploit the company’s IT, or a wordpress plugin, an AD vulnerability
Do yOu tRUsT tHiS maChiNe?
“No, but I’ll click yes this time because I know what you meant better than you do”
I hate passkeys. Fuck off with your passkeys. I will stop using Amazon because it won’t stop trying to add a passkey into my bitwarden
What’s wrong with passkeys? my preferred method. Hell I wish everything just used those and no email password shit
Try losing your phone and see how easy is to recover from that, or having to explain to your grandma how they lost their accounts everywhere because they didn’t have a backup strategy for passkeys, even though they remember the password for the account (!).
There’s also the very big issue of attestation, where websites can force users to use a specific password manager, which doesn’t allow you to move the key to a fully free solution. This was made for companies to force the users to use real hardware tokens or only approved authenticator apps, but nothing prevents google to start forcing you to use only google authenticator to login to google, or for apple to own an iphone to login to a site. Usually all big-company passwors managers don’t have any way to export the key, and you have to wonder why.
This attestation threat is very real: here is somebody that AFAIK was part of the w3c committee that made passkeys threatening to use attestation against keepassxc for allowing the user to export keys: https://github.com/keepassxreboot/keepassxc/issues/10407
Overall, it feels like yet another complicated technology, that also allows big companies to consolidate power.
Every conclusion you just made is wildly incorrect, or at the very least misleading or misunderstood.
Try losing your phone and see how easy is to recover from that, or having to explain to your grandma how they lost their accounts everywhere because they didn’t have a backup strategy for passkeys, even though they remember the password for the account (!).
If you lose your Amazon passkey, you can switch back to another 2FA method. Same for Google, and honestly, every other place I have a passkey in play. Adding a passkey doesn’t delete your password or other 2FA.
Losing your phone usually doesn’t lose your passkeys anyway. Apple, Google, 1Password, and Bitwarden sync them, so they come back when you sign in on a new device.
There’s also the very big issue of attestation, where websites can force users to use a specific password manager, which doesn’t allow you to move the key to a fully free solution. This was made for companies to force the users to use real hardware tokens or only approved authenticator apps, but nothing prevents google to start forcing you to use only google authenticator to login to google, or for apple to own an iphone to login to a site.
Apple’s and Google’s synced passkeys provide no attestation, so a website can’t cryptographically tell which password manager made them.
A site can read the provider ID (AAGUID), but without attestation it’s self-reported and can be faked, so in the wild it’s useless as a way to block people. It’d be no different from Google requiring you to use Chrome, which they could already do today, but don’t.
Enforced provider restrictions do exist, but only in controlled enterprise setups with hardware keys or managed authenticators, like Entra ID allowlists.
Also, to note: Google Authenticator is a TOTP app. It’s not where Google stores passkeys.
Usually all big-company passwors managers don’t have any way to export the key, and you have to wonder why.
Out of date. Apple added passkey export/import in iOS/macOS 26, and Google added it to Google Password Manager in June 2026. Microsoft is the holdout: it can import but not export yet. Bitwarden also lets the end user export passkeys. The industry standard is built to move passkeys app-to-app, not as plaintext files that could be exfiltrated.
This attestation threat is very real: here is somebody that AFAIK was part of the w3c committee that made passkeys threatening to use attestation against keepassxc for allowing the user to export keys: https://github.com/keepassxreboot/keepassxc/issues/10407
He asked the KeePassXC project to “put basic protections in place and collaborate with the ecosystem/industry,” and said attestation would allow RPs (websites) to block it. The pressure was real, but it was a warning about plaintext export, not a plan to lock people in. A plaintext passkey file can be grabbed by malware or talked out of someone by a scammer, which is why the industry built an app-to-app transfer standard instead.
Good to know that they added exporting!
It might make it a bit more acceptable for me, if it’s possible to move the keys to an open password manager.
The initial implementation with the risk of lock-in soured me so much that I just gave up and never looked at it ever again.
I also don’t trust FAANG companies, and them pushing the technology so hard made it an instant turn-off.
There’s a lot of other better reasons to stop using amazon, but if that’s the one for you, it’s still a victory if you stop using them.
