Click login button -> Use your passkey -> Done
It is not being fixed because the people that decide whether it needs fixing or not are so wealthy that they have dedicated servants to take care of that drudgery. You’re an NPC that is a programmable cog in their passive cash flow generator, not a person.
Logging in is a 17 button process these days.
Why does this meme presume a log in is even necessary!!
My job uses a Yubikey, authenticator, and more than 6 passwords, one of which for some damn reason at random points in a day thinks I’m on a seperate machine and forces me to get a verification code in my email. On top of that, one password resets every 3mo, another at 3 weeks, and the others are like every 8mo. All remember past passwords, will not allow any variation or similarity (you had a twelve char password with a number at the end in 2021, try another). It is a damn struggle creating a new password 12 years in now.
Are you allowed to use a password manager, like 1password or Bitwarden? I juggle with docens of passwords per client, all with different expiration dates and complexity rules. A password manager is the only reason I can get them all straight. A good password manager should let you save your passwords, passkeys, recovery codes and MFA codes all in one app locked with a single password + MFA
How much time do you spend on that per week?
I got a new phone and tried using the Merlin birding app but now I need to enter an email, receive an email, confirm using the link in the email…
…and then enter the user name and password I’ve been using to log into the app for years.
And it’s not just once but every time I use the app, it’s a nightmare, and I don’t want to give any extra information I don’t have to.
Find login button hidden on signup page
This one makes me irrationally angry
no, it’s rational
It has the same energy as insurance companies or ISPs that only offer good deals to new customers.
I just paid all of my bills and had to login to each account. Once a month torture session lol.
i just have my bank do that.
Logging in shouldn’t feel like passing an exam. Just let us access our accounts!
if ousing 2fa code is “like passing an exam,” maybe the internet is too hard for you.
bot
Don’t forget to accept the cookies [YES] [no]
Except you accept cookies in X browser, but not Y browser because that is an emulated system to run a 30yr old program they never bothered to update because it worked great on x86 machines but was never designed for 64 bit.
Don’t not deny allowing access to remove access to cookies!
Finally bout up sign in ~ "iS tHis YoU???!!? [yes][no] "
Autofill will typically check the URL of the site, byte for byte.
I wonder if the hacker will accept the whole Bee movie script as a password…
Now you made me wonder if the bee movie script is in a rainbow table somewhere
Bad link won’t autofill though because it’s the wrong url
That’s when you go to your password app and click autofill yourself.
There are plenty of ways.
DNS poisoning with one of those #4 private keys would be the easiest.
Getting Grandma to add a trusted CA would be another.
Paste bombs into browser terminals.
Something you have is a very important part of keeping people out of your stuff.
Once they are at the level where they break HTTPS, they can also ask you for the 2FA code or passkey and intercept that through their services, and you’d be hacked anyway.
Passkeys don’t work like that. They would, in fact, stop that from happening.
That is of course if the company didn’t let you choose another method
I didn’t test it (of course), but I think they do for this case.
So we have a man in the middle attack, that proxies traffic to a website through it and just decrypts it without changing it during the login. This is similar to what cloudflare does. The browser has no way to know somebody is spying: HTTPS cerificate is ok(stolen cert), the domain matches the expected(dns poisoning), even the page is exactly the same, so it performs the passkey challenge/response. The only thing that changed is the certificate, which is not suspicious (certificates can change normally!).
The attacker is not able to clone the passkey, but they are able though to steal your session cookies after the login. Instead of giving you the “login success page” they keep you waiting on a loading page while they navigate (with a script) with your stolen session cookies to the “add passkey” page of the site to add theirs.
If the website asks them again for the passkey as confirmation, instead of serving the “login successful page”, they serve the new 2FA prompt to you. You are left wondering “Didn’t I just do the 2FA? What a buggy site!”. And unknowingly approve adding the attacker’s passkey.
Game over, account fully compromised.
We are lucky that HTTPs is very good for security, they revoke certificates very quickly if this happens, and browsers check the certificate transparency logs making it impossible to forge a new certificate, even if you got hold of a root certificate with private key “4”. This attack also needs unrealistic level of compromise: stolen and unrevoked certificate + a poisoned DNS. Completely unrealistic scenario, but it’s not passkeys that saved you, it was HTTPS.
When they say passkeys are unphisheable they mean you can’t usually copy them and give them to an attacker, but an attacker can absolutely still add theirs to your account.
You forgot the “click to verify you are human” (followed by a dumb captcha, maybe 10) just after you click login but before logging in, which makes you, after you pass the captcha, click again to login.
Nah fucking email code every time! Just let me use ausernsme and password fucking god damned it. I don’t want my email involved in this process!
Your password is 30 days old. Make a new one. It can’t be the same as any of your last 37 passwords.
Mark, is that you?
