Remix.run Logo
▲ throwaway63467 a day ago

Everything feels so cumbersome. I click on a link in some app which takes me to their login which takes me to MSFT login which takes me to the 2FA provider which asks me for a passkey which takes me back to MSFT which asks me whether to remember which takes me back to my app which forgot the redirect on the way which takes me back to the home view from which I navigate back to where I wanted to go where I can finally see what I wanted to see. Surely there must be a better way.

▲skybrian a day ago | parent | next [-]

Yes, web apps should support passkeys directly and have a "log in with your passkey" button if there's a cookie indicating that you previously logged in with one. Also, don't screw up the UI by then sending you an email or text message with a confirmation code.

(If it's a browser that you haven't used before, perhaps be a little more paranoid.)

▲yread 19 hours ago | parent | prev | next [-]

Yeah. The other day I registered into something using my institutional login (with 2FA). And then i have to activate 2FA in the relying party as well. So everytime i login there i need 2 2FAs.

▲Zanfa 17 hours ago | parent | prev | next [-]

Most of my current company runs on Teams, which is such a massive self-inflicted gunshot wound. It must cost billions in lost productivity across the globe, just dealing with how terrible it is.

A few examples that happen pretty much every day:

1) The teams interface takes upwards of 60 seconds to load, from the moment I've gone through the auth process and the Teams logo pops up, from when the UI actually renders the sidebars and the first chat window.

2) It frequently fails to load new messages after resuming an existing session for a few minutes. It shows everything up to date, you can navigate between chats, but no new messages or unread message counts update. Then after s a few minutes, it suddenly works, but it's impossible to tell if it's working and you don't actually have any messages or if it's in this limbo state.

3) When you need to reauth, the app seems to work, again showing all the previous messages, but there's this tiny toast at the top saying that you need to log out.

4) The log out button doesn't actually work. On Chrome, I've had to use devtools to clear my cookies & sessions for it to get into a valid state where it would actually let me sign in again. The Mac app just goes unresponsive and needs to be forced to quit.

I didn't feel the tiniest bit bad for all the companies going down thanks to MS this week. Alarms have been blaring for years and nobody cares.

▲stavros a day ago | parent | prev | next [-]

I really hate this bullshit "security". Why on earth do I have to log in every single day? If anything, it gives an attacker more chances to either steal my password, or makes me more likely to be phished because logging in is so automatic now.

It has negative security. Log me in for a fucking month, stop wasting a minute of my time every day!

▲ a day ago | parent | next [-]
[deleted]
▲andyfilms1 a day ago | parent | prev | next [-]

It's also crazy that as far as technology has advanced, the concept of the username/password is still so prevalent. Passkeys are sort of changing things, it all still feels decidedly low-tech. Edit: Can you get a Yubikey as an RFID implant? ...asking for a friend.

▲surgical_fire a day ago | parent | next [-]

What is really crazy is that things that should be just an application locally installed on the device (such as PowerPoint) need a login at all.

There's a secondary issue of schools pushing children to use proprietary applications when perfectly serviceable alternatives exist (especially for school level work).

How the hell we all normalized this crap is maddening.

▲paradox460 19 hours ago | parent | next [-]

It's not even new. 20 years ago I got a bad grade in highschool because I used StarOffice and not Office 2003 for a project

My father and I had an unreasonably long conversation with the dean of students about how requiring someone to purchase a $300 software suite for a basic highschool English class was egregious

▲port11 16 hours ago | parent | prev [-]

The school in the linked post actually requires 3 separate logins before you can see the presentation, that’s just…

▲WorldMaker 13 hours ago | parent [-]

One of the "best" parts being the first one of those was meant to be an "SSO" but apparently is design-by-committee and very bad at it. (Requiring too frequent logins, not saving usernames between logins [for kids?!], requiring login dances at downstream logins.)

▲throwaway27448 a day ago | parent | prev | next [-]

> the concept of the username/password is still so prevalent

How can you improve on it? You have the identity part and the auth part. What is better than that?

▲crote 12 hours ago | parent | next [-]

Making it phishing-resistant, for starters. And having a built-in way to prevent people from reusing their password across multiple websites, so that any single compromise doesn't instantly turns into having all of their accounts pwned.

▲MisterMunchkin 19 hours ago | parent | prev [-]

Passkeys. That has both and it can’t be set insecurely, written on paper or given to an Indian call centre who assures you they are from the finance department.

▲throwaway27448 18 hours ago | parent [-]

How do you identify whose passkey it is without an identity? They're a decent defensive auth method for people who can't use a password manager but they can't replace username/password.

▲crote 12 hours ago | parent | next [-]

Passkeys as they are currently-marketed are resident credentials. This means a passkey stored on your Yubikey (or smartphone, or Windows account, or...) is not only a private key, but also contains a UID to identify it. A website doing authentication can trivially use this to look up which user it is associated with. Very convenient for single-press login, but it requires a decent bunch of per-website storage on the hardware token. Which is of course a net positive for the big tech companies, because it forced you into using smartphones as the token, and doing silly things like cloud sync with them.

The original FIDO U2F credentials were not resident. You'd enter your username, and the website would sent over a bunch of opaque blobs representing the associated hardware tokens. The hardware token would decrypt their blob using a key derived from a combination of the website's domain name and the hardware token's single stored secret, and then do the whole auth shenanigans using the data retrieved from the blob. Yubico invented a very nice protocol[0] around this "server-stored blob" idea to allow registering a backup security token, but the strong push towards insecure smartphone-stored cloud-synced Passkeys of course killed this.

[0]: https://www.yubico.com/blog/yubico-proposes-webauthn-protoco...

▲WorldMaker 13 hours ago | parent | prev [-]

username/passkey works just fine. No password needed. Nobody said drop usernames, the idea is drop passwords.

▲dprkh a day ago | parent | prev [-]

Username/password is the easiest way to log in, assuming there is no stupid format requirements. It's just two strings stored in your password manager. The most retarded way to implement log in is actually magic email link, which requires opening your email client, waiting for the email to arrive, and copying the code. If you want to make it even worse, you can require that to be done using the same browser that is trying to log into the account.

▲nozzlegear a day ago | parent [-]

There's no need to use slurs.

▲antonvs 20 hours ago | parent [-]

Is it a slur if it's describing a process, rather than a person?

▲defrost 20 hours ago | parent [-]

Yes.

▲antonvs 11 hours ago | parent [-]

There are still plenty of technical and scientific uses of the word in various forms, including retard, retarded, retardant, and retardation. One that’s in common use outside the sciences is “flame retardant”.

Technical usage, where the word is describing a quantity, process, or function include: retarded time, retarded position, retardation time, regarded coordinates, retarded Green’s function, retarded potential, retarded acceleration, and retarded ignition.

In all these cases, it’s used to refer to something whose progress is delayed or impeded in some way, which is the original meaning of the word “retard”, that also ended up being used in medicine and psychology and becoming a slur in those contexts.

So the correct answer to my original question is either “no” or “it depends”, with the latter requiring some qualifying criteria.

▲defrost 4 hours ago | parent | next [-]

The correct answer is that the manner in which you used the word in the context above was as a slur. As you're no doubt well aware.

Full stop.

▲nozzlegear 10 hours ago | parent | prev [-]

This is just sophistry. You and I both know what they meant when they said "the most retarded way".

▲giovannibajo1 a day ago | parent | prev | next [-]

Because the alternative is that a very long or unlimited session cookie can be stolen and used for months to impersonate you. That’s the tradeoff

▲joshuagarner a day ago | parent | next [-]

When was the last time that happened to a Gmail account? It has unlimited cookie sessions.

▲longcookiesaas a day ago | parent | next [-]

I actually did this for my small saas Ive sold to a couple dozen companies, and while all my programming friends at the coworking office said I was crazy, Gmail and facebook were my go to answers. If they can do it safely, I might as well try.

▲Hnrobert42 a day ago | parent [-]

Username checks out!

▲BenjiWiebe a day ago | parent [-]

Yes, they made the account to post that comment. Might as well make the username relevant.

▲crote 12 hours ago | parent | prev [-]

Maybe Gmail, but definitely not GCP. I have to re-auth every day or two for that.

And even with Gmail there's a decent chance it isn't just "blindly trust unlimited-duration token". Cookie stealing is now one of the main forms of credential compromise, so I bet there's some form of browser and/or IP verification going on to demand a reauth when some `curl` instance from a Russian VM tries to make use of it...

▲jasonjayr a day ago | parent | prev | next [-]

Then connect the browser directly to the secure element of the device, so the session cookie is cryptographically signed by something you are physically in possession of.

▲joe5150 a day ago | parent | prev | next [-]

Logging and alerting the user that their account is being used from a new context and requiring reauthentication when accessing the account from an unfamiliar IP/user agent would mitigate this to some extent.

▲stavros a day ago | parent | prev | next [-]

I'll take that risk, especially since I've basically never heard of a successful attack hinging on a stolen session cookie being used for months. Either you do what you'll do within a few minutes, or you never do.

▲zdragnar a day ago | parent [-]

That's a great way for someone to siphon a lot of session tokens and then auction them off to a black hat.

It's also a great way to lose everything if you happen to lose your phone or laptop and it gets found a few hours or a day later and the antagonistic finder guesses your weak PIN.

In the US, service providers and manufacturers are often held liable for losses if they make something that has sub-standard security. Kia, for example, was held liable for making their cars too easy to steal. Banks have boatloads of things they have to do to protect their customers.

It's not really your choice to take the risk here, apparently.

▲gosub100 a day ago | parent | prev | next [-]

TPMs / secure enclaves can (in theory) prevent sessions or cookies from being stolen. Not claiming there aren't other attack vectors though.

▲crote 12 hours ago | parent [-]

Are those used in practice, though? I'm not aware of any "sign request headers with private key cookie stored in TPM" HTTP extension, but I would love to be proven wrong.

Of course, in practice that would just turn cookie-stealer malware into request-proxying malware.

▲ktallett a day ago | parent | prev [-]

The alternative is offering offline versions of apps to students and allow students to open downloaded items off the cloud locally. It also means students don't require internet access when off campus.

▲HPsquared a day ago | parent | prev | next [-]

Because everything is sitting out on the public internet now, only protected by those things.

▲LadyCailin a day ago | parent | prev [-]

My web app makes you enter your password two times before you can log in. It’s twice as secure!

▲ToucanLoucan a day ago | parent | prev | next [-]

I don't remember the last time I had a workday that didn't involve logging into something that I definitely logged into not very long ago, that I use every single day, and it's so, so, so fucking tedious.

And it doesn't escape my notice that all the fucking things I have to log into over and over and over are using Microsoft auth. Which granted, I think every office worker would notice that just from the ubiquity of their software, but still. And, on top of it, Microsoft's login flows are remarkably, consistently clunky. The forms jump all over the place and it has to refresh the page like 5 times as it's processing your credentials, and lord help you if Outlook needed you to sign in and silently opened that stupid auth window, because if you go through the entire thing, odds are great that you'll get a "security token expired, please do it again" message at the end. Like I dunno personally I wouldn't get a security token until the user has actually interacted in some way with the stupid form but what do I know I've only been making software for like 13 fucking years.

Oh yeah, bonus points: I use the passkey thing for my MS Auth app on my phone, and every single goddamned time I sign in, it asks me if I want to.... wait for it... create a passkey.

Edit: Oh oh and, for the above? If you're working through your morning coffee and accidentally click OK instead of cancel, it'll sit there spinning forever, not sign in correctly, and then you get to do ALL THIS BULLSHIT AGAIN.

Just, truly the biggest circus with the most clowns over there.

▲Izkata a day ago | parent | next [-]

Microsoft's auto-logout appears to be implemented in the frontend. If I leave the Outlook or Teams tabs opened but idle for a few hours I get kicked and have to log in again, but I have an addon that will unload tabs I haven't interacted with for an hour, and one day I noticed that if I click away and intentionally let those tabs unload when I'm not using them, I can stay logged in for weeks or months.

▲vrmiguel a day ago | parent | prev | next [-]

Fortunately I don't have to deal with Microsoft professionally, but anything Xbox related is also such a massive pain. More than 3 times now I've tried to login and got into an endless login loop.

If you look that up you'll see that people have been encountering that for over a decade.

I simply and truly don't get it.

Microsoft must have at least 80.000 devs. No one there ever wanted to fix this?

▲crote 12 hours ago | parent | prev | next [-]

I genuinely could not care less about it. Most of it is trivial click-through session validation (Github -> Microsoft auth -> Github) where most of the pain is solved by auto-redirect, the rest is auto-filled by my password manager - including 2FA, although that part is technically probably not the best idea.

If I ever have to manually fill anything in, it is almost certainly going to be a phishing attempt. It immediately jumps out as "this is unusual, something is wrong here".

The only thing which bothers me is email login links, but luckily I don't daily any apps which use them.

▲Marsymars a day ago | parent | prev [-]

> lord help you if Outlook needed you to sign in and silently opened that stupid auth window, because if you go through the entire thing, odds are great that you'll get a "security token expired, please do it again" message at the end.

Whenever I see the Outlook auth box I mash in some gibberish for my password to immediately get the "expired" notice so that I can enter my real auth info.

So if any admin happens to look, my baseline for incorrect passwords entered is 50%.

▲throwaway27448 a day ago | parent | prev [-]

Sure there is—local apps.