alt Hacker NewsEverything feels so cumbersome. I click on a link in some app which takes me to their login which takes me to MSFT login which takes me to the 2FA provider which asks me for a passkey which takes me back to MSFT which asks me whether to remember which takes me back to my app which forgot the redirect on the way which takes me back to the home view from which I navigate back to where I wanted to go where I can finally see what I wanted to see. Surely there must be a better way.
Replies
I really hate this bullshit "security". Why on earth do I have to log in every single day? If anything, it gives an attacker more chances to either steal my password, or makes me more likely to be phished because logging in is so automatic now.
It has negative security. Log me in for a fucking month, stop wasting a minute of my time every day!
I don't remember the last time I had a workday that didn't involve logging into something that I definitely logged into not very long ago, that I use every single day, and it's so, so, so fucking tedious.
And it doesn't escape my notice that all the fucking things I have to log into over and over and over are using Microsoft auth. Which granted, I think every office worker would notice that just from the ubiquity of their software, but still. And, on top of it, Microsoft's login flows are remarkably, consistently clunky. The forms jump all over the place and it has to refresh the page like 5 times as it's processing your credentials, and lord help you if Outlook needed you to sign in and silently opened that stupid auth window, because if you go through the entire thing, odds are great that you'll get a "security token expired, please do it again" message at the end. Like I dunno personally I wouldn't get a security token until the user has actually interacted in some way with the stupid form but what do I know I've only been making software for like 13 fucking years.
Oh yeah, bonus points: I use the passkey thing for my MS Auth app on my phone, and every single goddamned time I sign in, it asks me if I want to.... wait for it... create a passkey.
Edit: Oh oh and, for the above? If you're working through your morning coffee and accidentally click OK instead of cancel, it'll sit there spinning forever, not sign in correctly, and then you get to do ALL THIS BULLSHIT AGAIN.
Just, truly the biggest circus with the most clowns over there.
Yes, web apps should support passkeys directly and have a "log in with your passkey" button if there's a cookie indicating that you previously logged in with one. Also, don't screw up the UI by then sending you an email or text message with a confirmation code.
(If it's a browser that you haven't used before, perhaps be a little more paranoid.)