4 ms·
Logging in. First I need to make an account for nearly everything. Then I need to link that account to a phone number or email. Then every time I use the ser
by aimor 5y ago
Logging in.
First I need to make an account for nearly everything.
Then I need to link that account to a phone number or email.
Then every time I use the service I need to wait for them to text or email me a password.
If they email me the password then I have to log in to my email, which means getting another password texted to me.
Alternatively if it's work related I have a physical key card, a physical password generator, and a slew of personal passwords I just memorize. I have to keep all of these on me just to log in: regular keys, cell phone with service, email, key card, password generator, and ideally a different password memorized for every service which need to be changed every 60-180 days.
Maybe an example is needed, this is a typical day: I want to use the building's front door, so I use the key card. I want to use my office door so I use my regular key. I want to use my laptop so I use a memorized password. I want to connect to the network so I use my physical password generator with a memorized password. I want to read an encrypted email so I use a memorized password. I want to download a file from a document share with another company so I use a memorized password and get texted a password. I want to use the computer lab so I use a key card and a memorized password and another key card and another memorized password. I want to buy something online so I create a new account with a memorized password and get emailed a password so I log into my phone with my thumbprint and my email with a memorized password and get texted a password. Then I buy the thing with a credit card number and code which I've memorized since I get so much practice memorizing things now. I probably verify my identity a hundred times every single day, and businesses seem to be adding more and more ways to do it, making it more and more difficult.
I remember being impressed by my grandfather's keychain when I was a child, thinking "wow, how can someone need this many keys?" ...
- vb6sp6 5y agoget a password manager. some of them are quite good and will even fill out usernames and passwords which makes maintaining a junk account for non essential websites easier to use
- 4ggr0 5y agoWhat's a physical password generator? Sounds interesting.
- ac2u 5y agoCould be referring to diceware https://theworld.com/~reinhold/diceware.html https://theworld.com/~reinhold/diceware.html
- par 5y agoI use 1password for everything, and as great as it is, it isnt a seamless and bulletproof solution. No password manager is. The log in experience is EVERYWHERE and I have to generate new passwords seemingly everyday for new sites and apps.
- 4ggr0 5y agoI use Bitwarden but I know what you mean
- aimor 5y agoA token generator, a little device where you push a button and get a password. Sorry that the language was confusing, I wanted to make the point that tokens, codes, keys, whatever they want to call them are another password.
- 4ggr0 5y agoAh I see, you mean 2FA or Two-Factor Authentication, right?
- psyc 5y agoIt seems like no matter what improves in this area, something else breaks it. At first using a password manager helped. So now everyone wants to email or text a code if they don’t recognize the device/browser. But there’s a checkbox to remember the device/browser! And I find more than half the time the checkbox has no apparent effect. There’s like a Murphy’s Law of Logins: Whatever frustration can be caused, will be.
- stnmtn 5y agoFor logins that are important, I appreciate the extra security of 2FA and am not frustrated by it. Also, for many people they re-use the same password for everything, so enforcing 2FA makes sense for them as well
- jfrunyon 5y agoI don't think anyone is complaining about the option of 2FA on logins that are important. What people are complaining about is the requirement of 2FA which only supports email, text, or call. All of those options take significantly more time and distraction than my normal 2FA processes (TOTP or WebAuthn). Furthermore all of those options add next to no security because all you have to do is get physical access to someone's phone (not unlocked, just access to the lock screen!) to receive the codes. And even if that's not possible you can just bribe or SE a $telco employee.
- psyc 5y agoComplaining that my car key weighs 10 pounds isn’t a prompt to remind me that people steal cars.
- SamuelAdams 5y agoThis is why I love Reddit and Wikipedia. You can make an account, but you don’t have to. Compared to say Pinterest, where content can’t really be accessed at all unless you make an account.
- danskeren 5y agoReddit doesn't deserve the love. Forced to login to view content (for everyone that doesn't know 'old' exists), can't download their videos, ban bots that present a downloadable link, obnoxious popups to download their apps, unable to reject cookies on 'old.reddit.com' without first going to 'new.reddit.com' to set preferences, trick users into giving them your email, etc.
- cmh89 5y agoHell, reddits' interface is so terrible and slow that its a basic requirement to get an account solely so you don't have to use it.
- trash3 5y agoReddit is literal evil. Last time I used the new Reddit, the up vote scores and comment counts change in real time on the screen. Like what the fuck.
- doubled112 5y agoIs there a fuzzing algorithm used on votes so that early in the voting you can't tell whether it's up or down? There are also some subs that hide vote counts for a period of time. I assumed this was just a more aggressive way to stop the spam votes.
- jfrunyon 5y agoFirst off, you absolutely do have to make an account to participate on Reddit. Second, screw Reddit, between shadowbans and required external IDs to register and the various new anti-user design updates... No, they're not a positive example of anything anymore.
- jfrunyon 5y agoReddit used to be amazing. "Just pick a username and password. Give us your email if you want to be able to do a password reset." Now an email (with verification) is required and you'll still get insta-shadow-banned.
- throwamon 5y agoActually, no, an email is not required. It's a dark pattern. You just need to click "Continue" without entering any email address.
- benhurmarcel 5y agoSome subreddits (like /r/linux) will delete your comments if you don’t register an email though.
- throwamon 5y agoWow, is that an official option for mods?
- benhurmarcel 5y agoThey just program the Automoderator bot to delete those comments
- jfrunyon 5y agoHmm, it gave me an error message and wouldn't let me continue until I had put in my email address a few weeks ago when I was making a throwaway. Not doing it now though. I suppose either they're experimenting or maybe they just don't like my ISP.