8 ms·

Ask HN: Are others seeing Google's reCAPTCHA rejecting Firefox users?

257 points by Animats 29d ago

Infinite Google ReCAPCHA loop trying to access archive.is using current Firefox from Linux. Just started today. Firefox is in "strict" mode. Disabled Privacy Badger for that site, and it didn't help. Tried private browsing, and it didn't help. Is this part of Google's war against ad-blocking and non-Chrome browsers?

deleted 29d ago
[deleted]
nosioptar 29d ago
Yup, I get stuck in a loop. Sometimes the audio recaptcha works. But, most of the time I can't understand the garbled audio. Closing the tab always resolves the problem.
KomoD 29d ago
archive.today doesn't use a real recaptcha, the cloudflare page isn't real either. it serves that as a punishment for using 1.1.1.1 DNS because the owner doesn't like that 1.1.1.1 doesn't send EDNS client subnets.
- foresto 29d ago
  What do you mean by "a real recaptcha"? I just went to an archive.is page, and it's trying to load a script from www.google.com. Doesn't Google still own reCAPTCHA?
  - selcuka 29d ago
    > On 14 January 2026, it emerged that archive.today had silently modified its CAPTCHA page to send repeated requests to Gyrovague, thereby causing visitors to unwittingly contribute to a DDOS attack against the blog. https://en.wikipedia.org/wiki/Archive.today#2026_attack_on_Gyrovague_and_Wikipedia's_restrictions https://en.wikipedia.org/wiki/Archive.today#2026_attack_on_G...
    - cactusplant7374 29d ago
      It is telling that HN moderators allow links to archive.is/today
      - dcminter 25d ago
        Rather than telling us that it is telling, perhaps you should tell us what it tells you and why?
        pessimizer 25d ago
        Better to just ignore the anti-Russian and hasbara spam. It's being posted opportunistically. The chance to attack archive.is in an organically posted thread is probably the only reason an intermittent outage (common) of archive.is was upvoted enough to make it to the front page. Look at the top comment.
        Plont 24d ago
        Why does it feel like everyone has just ignored/memory-holed this? https://arstechnica.com/tech-policy/2026/02/wikipedia-bans-archive-today-after-site-executed-ddos-and-altered-web-captures/ https://arstechnica.com/tech-policy/2026/02/wikipedia-bans-a... That whole debacle is even specifically relevant to this thread because the operator of archive.today (aka archive.is) was caught using a script on its captcha page to make visitors' browsers connect to the blog they were mad at. That's how their DDOS attack worked. They used their own visitors, who naturally trusted the captcha page, to commit a crime. For whatever reason, with the exception of Wikipedia (bless the editors), they seem to have gotten away with this, as well as with deliberately falsifying the content of "archived" pages (as described in the arstechnica article), without consequences. So, call me crazy or a Russian bot if you want, but I think it's reasonable to be suspicious of any weird captcha behavior from this website in particular.
        cactusplant7374 24d ago
        And HN users are being used as part of these attacks?
- gruez 29d ago
  They're definitely trying to mimic the cloudflare captcha page, but... >archive.today doesn't use a real recaptcha How? It's loading the script from google, and the images/responses are from google to.
  - KomoD 29d ago
    I recall that the 1.1.1.1 block page doesn't serve the real one,, but the challenge page that they serve normally does. Maybe I'm misremembering? or maybe they changed it.
    - gruez 25d ago
      I just tested and it's the "real" recaptcha, with requests to google and everything. It still might be "fake" in the sense that the server rejects any response, even valid ones, which is probably what's actually happening.
bflesch 29d ago
This has been happening since many months.
- fuzzfactor 25d ago
  It's garbage all over the place. Advertisers on Google should be paying a lot less than they were a year ago.
  - paganel 25d ago
    > Advertisers on Google should be paying a lot less than they were a year ago. I wonder how the Google Search page traffic has been affected by the recent AI surge. Very anecdotally, of course, but in my social circle (middle-class urban Romanians in their late 30s and early 40s) almost everyone I know has replaced a phrase like "I googled it and I found this and this and this" to "I chatGPT-ed and I found this and this and this" (where "chatGPT" can also be sometimes replaced by Claude and, not that often, by Gemini).
realslimjd 29d ago
I frequently have this issue with Safari in private browsing.
gnabgib 29d ago
It doesn't work in Chrome either (please complete CAPTCHA/yes you're valid/repeat), it might be a config issue on archive.is (Firefox latest windows, Chrome 151 windows - guest/null profile on both) rather than a war move.
selcuka 29d ago
It's an archive.is issue: https://en.wikipedia.org/wiki/Archive.today#2026_attack_on_Gyrovague_and_Wikipedia's_restrictions https://en.wikipedia.org/wiki/Archive.today#2026_attack_on_G...
- pessimizer 25d ago
  What does this link have to do with anything?
  - gruez 25d ago
    They have some spat with cloudflare, so they "punish" cloudflare users by sending them into infinite captcha loops
    - emsign 24d ago
      They have nothing to do with Cloudflare. Their challenge page is only made to look like the one from Cloudflare. It's entirely their own page. Only the reCaptcha challenge is not theirs. And the reason why nobody gets redirected is because the have used up their free enterprise quota with reCaptcha, as you can read in the widget itself.
- emsign 25d ago
  It's not that. Archive.today have simply used up their free quota.
busymom0 29d ago
Not sure about Firefox but lately, if I access Google from Safari on my Mac with Apple's private relay on and private mode Safari, I get an endless captcha loop.
globalnode 29d ago
because of my privacy settings google search outright blocks me as a bot. the only way to search is through an intermediary like startpage. related because if it does give me the time of day i tend to then get endless captchas.
- tekla 29d ago
  [dead]
KinetiNode 29d ago
Yes , it (somehow) worked for me when I used VPN for a few days before not working again
kotaKat 29d ago
Dunno, but is anyone else continuing to seem to get what feels like 3-4 minute reCaptcha challenges? I’m getting mentally exhausted having to try to solve the super blurry pick-the-streetlights they keep throwing at me in loops. It feels like I have to go slowly through it only for it to eventually end in a “please try again” as I sit and wait ten seconds for each square to slowly fade in a new stupid bus for me to click. How is this fair to the humans?
- StilesCrisis 25d ago
  This is a tarpit. They've decided you're almost certainly a bot. If you're willing to solve the captchas for three minutes straight, they eventually might relent and let you in, or maybe not.
  - bluGill 25d ago
    I doubt any human would solve them for 3 minutes straight, but a bot might. So closing and reloading the page (something a human would do) might work. Of course bots that don't do this will quickly figure out that they should - just like every other attempt to figure out if this is a bot or not... There is no good automated answer. Things bots do to abuse web pages should be made illegal and then jail (fine...) the people who set the abusive bots loose - but I suspect most abusive bots are foreign and so we can't do anything without sending in an army (obviously unacceptable)
    - kotaKat 25d ago
      > I doubt any human would solve them for 3 minutes straight Cognitive overload. There's days I'm just straight up tired and don't realize it until I'm at least one "please try again", page refresh, and endless traffic light game later that I'm probably in the tarpit and wonder why. The weird thing is that I don't KNOW why. I use good ol' consumer Chrome, good ol' consumer MacOS, a consumer ISP, and my IP isn't in any kind of reputational blacklists that I'm aware of.
      - 25d ago
VCFundedGenYer 29d ago
I've seen weird situations where I'm objectively solving the captcha correctly yet it still doesn't recognize it as correct. At this point captchas need to be completely removed everywhere. They aren't effective and just waste time.
- deltoidmaximus 29d ago
  Captchas are often used as tarpits. They've already decided you're a bot based on other factors so you aren't getting in until you change those factors. I've seen this happen where I'm stuck in the loop and then change the VPN endpoint and get right in after one try.
  - Aachen 25d ago
    I'm sure there exist examples where people maliciously give tasks (captchas) out that have no chance of getting the person anywhere, but it's definitely not common
    - bityard 25d ago
      Consider yourself lucky. I routinely run into tarpit Google reCAPTCHAs and I don't even use a VPN. I think it's because I run Linux and the site admins treat anything besides Windows, Mac, iOS, or Android Chrome as suspicious enough to blacklist. It has gotten to a point that I literally never even _try_ to do image-based CAPTCHAs anymore. If I can't access the site, oh well.
      - Aachen 24d ago
        I also get infinite captchas but it's imo not a tarpit if it's not intentional but a bug Edit: looked up the term, DDG shows a Wikipedia card saying "A tarpit is a service on a computer system that purposely delays incoming connections." (purposeful) It may seem purposeful on Google's part but I bet that if we could get through to the developers for answers, it's probably not designed that way but we're running into a case where the system isn't designed to handle it Which could be said to be intentional (excluding people with our FOSS setup), I guess
prirun 29d ago
I've used vultr.com for years with no problems. Recently it wouldn't let me login without solving a Google captcha. I tried private windows, etc and ended up having to cancel my Vultr account and ask for a refund. Fortunately I only used them to spin up test VMs and didn't have any production stuff running there. I refuse to pay a company for service and then be required to identify motorcycles and traffic lights every time I sign in. I went a few rounds with Vultr customer service and they said (paraphrasing) "It's not something we can fix, you have to talk to Google about it". Right... Google forced you to put their captcha on your web site.
- pixelesque 25d ago
  I've had this for a few months trying to log into https://console.vultr.com/ https://console.vultr.com/... It does it for me if I use a VPN (Mullvad) - if I don't use a VPN then I haven't noticed I get them. But yeah, very annoying.
  - basilikum 25d ago
    Most captchas are invisible as long as they like your IP and device. But they still do the fingerprinting in the background.
- account42 25d ago
  CAPTCHA for login should just be outright illegal, especially if it blocks important functionality like closing your account.
  - PaoloBarbolini 25d ago
    A few years ago a service for which we had just implemented a scraper for (they had no API, and the customer needed info from 1000s of accounts) added a captcha right after we had implemented the scraper. We quickly figured out that the server didn't validate the captcha challenge code with Google. It worked for 3 years until they changed the system to send a code via email to validate your login, and limiting you to 1 session at-a-time. Now we have different problems to deal with...
europoorean 29d ago
Yes. I use Firefox in Linux, with or without private window. Switch to Chrome to test and voilà, all good.
- fransje26 25d ago
  I have the issue in Firefox and in Chromium.
nora-puchreiner 28d ago
The open secret: the CAPTCHA wasn’t actually being checked against Google’s servers; any answer was accepted as correct – until yesterday, when someone armed with this knowledge launched an AI crawler. Now it’s being checked, so you’ll have to solve it.
- gruez 25d ago
  I'm not sure why this is downvoted. It approximately checks out. An "assessment" only counts if your server tries to verify it, so you could conceivably use recaptcha for "free" if you don't bother validating the results. It also explains why other people have started seeing "This site is exceeding reCAPTCHA Enterprise free quota" message.
  - Plont 24d ago
    It's not possible to downvote comments on this website lol
    - qingcharles 24d ago
      If you're not seeing a downvote button your account is probably in some hole :p
adrian_b 28d ago
I do not think that this is Firefox specific, more likely is is something Linux specific. For me, hCaptcha has stopped working immediately before last weekend, regardless of the site that uses it. It goes in an infinite loop, despite solving correctly all challenges. On Linux, I have tested with 2 browsers, Firefox and Vivaldi, and the browser did not make any difference. I do not use any ad blockers, nor any non-standard extension. So I think that they deployed a version update last Friday, which for some reason is broken on Linux. It would not be surprising if both hCaptcha and Google ReCAPCHA have made some similar changes, so now they are both broken on Linux. Meanwhile, some other "Captcha" applications from other vendors, which are used on other sites, still work like before.
- oh_no 25d ago
  I get this pretty frequently on windows Firefox after switching to it, note this is my work computer, Firefox works fine at home on more open network
  - randcraw 25d ago
    I get reCaptchaed-to-death all the time in iOS and MacOS using both Firefox and Brave. I use a big name VPN which probably makes it worse, since I'm routinely blocked outright by Cloudfare services, assuming cluelessly that I'm a bot.
OutOfHere 27d ago
PubMed and PMC use Recaptcha and it's atrocious. It never works with Firefox. It keeps looping even when filled correctly. NIH support staff is even worse as they refuse to acknowledge the issue and reply with a scripted useless response. If I remember correctly, Recaptcha doesn't work on GrapheneOS either which is a separate issue.
- vient 25d ago
  Interesting, saw reCAPTCHA infinite loop for the first time in a long time just yesterday, on Firefox, and it was when I tried to access an article on PMC. Disabling uBlock and Enhanced Tracking Protection did not help. It looked like several automatic reloads, then one real reCAPTCHA showed, and infinite reload loop after I solved it. Does not reproduce today though, and I never had issues with PMC/NIH before that.
  - gpm 25d ago
    I've seen it on PMC. Strangely fixed by switching to a different firefox container ("container" in this context: https://support.mozilla.org/en-US/kb/how-use-firefox-containers https://support.mozilla.org/en-US/kb/how-use-firefox-contain...)
thrust26 27d ago
Anyone else getting this? Ich bin kein Roboter. Diese Website überschreitet das kostenlose reCAPTCHA Enterprise-Kontingent. I am not a robot. This website has exceeded the free reCAPTCHA Enterprise quota.
kiops 27d ago
[flagged]
Barbing 26d ago
Archive.today / Archive.is / Archive.ph issues the past few days. Safari Private w/iCloud Private Relay. See the enterprise free tier exceeded messaging: This site is exceeding reCAPTCHA Enterprise free quota. That’s new, but problems/loops aren’t.
deleted 25d ago
[deleted]
deleted 25d ago
[deleted]
mcv 25d ago
Can we just get rid of reCaptcha? It was fun when it was new, but now it's just pointless busywork to let Google know who we are. Does it do anything other than that? I don't for a minute believe bots can't solve that anymore.
- oh_no 25d ago
  It still works, bots can solve it but it probably increases the cost of that web call by 10x or 100x for that bot, so it won't bother. Had a recent bad experience with removing recaptcha.
  - mcv 25d ago
    I have bad experiences with recaptcha. It also increases user effort, and they might not bother either. AI doesn't get annoyed as easily.
ectoloph 25d ago
I've found that I can often stuck in tarpits on Safari for iOS with Wipr and iCloud Private Relay. The worst trigger is searching Google from the address bar. Loading the homepage first makes the problem notably less common. Or getting a couple wrong.
pessimizer 25d ago
I don't think it has anything to do with google, it's an intermittent issue on the archive sites that usually clears out within an hour or two. You're being successful, then being bounced back out again. Also firefox from linux. Just leave the pages open and refresh them every 20 minutes or so.
rmortyh 25d ago
I have been seeing this, but it depends on my originating IP. I switched my house from Spectrum to T-mobile and then started getting ReCAPTCHAs on Firefox. Going out through another Spectrum connection on the same machine doesn't trigger the ReCAPTCHAs. It happens far, far less with chrome but it does still happen.
Hamuko 25d ago
If you're seeing an infinite CAPTCHA loop on archive.is, it's more likely that you're on the operator's shitlist than any technical issue. All Finnish IP addresses are on that shitlist already.
- bulder 25d ago
  Yup. Before they just blackholed Finnish IP ranges instead, accessing the site from one would serve a fake Cloudflare page with a reCAPTCHA challenge and the DDoS script. (The tell of it being fake is y'know, that Cloudflare doesn't use reCAPTCHA) I can only guess the goal was to keep users on that page longer to keep sending off more spam requests.
WaasilaAsif 25d ago
Yes. And even after solving the recaptcha it just wont accept and after multiple attemots even if it accepts it just goes on to display it all over again
fransje26 25d ago
I also have the same issue in Firefox, Chromium and Vivaldi on Linux. I tried searching the interweb for a cause/fix, but couldn't find anything sensible in the flood of low-quality SEO hijacking webcrap returned by multiple search engines. So I asked AI. The claim is that it could be caused by the blocking of some DNS providers (NextDNS, Quad9, ..), and it suggested using a VPN or phone tethering. And lo and behold, both suggestions worked, without any browser setting changes. It's very annoying and inconvenient.
Barbing 25d ago
Neat, threads and comments can be reposted [by admins/mods?]: https://i.ibb.co/Q7qTtK16/Image.jpg https://i.ibb.co/Q7qTtK16/Image.jpg Note I posted the comment only once a day ago. Thread ID seems the same, but old timestamp is visible in my profile. Important issue for information freedom, HN relevant, so it’s back new on the front page? Edit: good job Social-Protocols, its graph accommodates this unexpected (to me) scenario: https://news.social-protocols.org/stats?id=49555592 https://news.social-protocols.org/stats?id=49555592
- PyWoody 25d ago
  Yes, it's the Second-Chance Pool.[0] [0] https://news.ycombinator.com/item?id=26998308 https://news.ycombinator.com/item?id=26998308
  - BoxOfRain 25d ago
    This is a good institution, helped prompt a discussion which was very useful to me about designing for e-ink.
    - Barbing 24d ago
      Really, how so?
      - BoxOfRain 24d ago
        https://news.ycombinator.com/item?id=49213660 https://news.ycombinator.com/item?id=49213660 I made this post and it died on its arse initially, didn't even get an upvote. The second chance pool meant that it turned into a useful discussion about a pretty niche element of frontend development.
        Barbing 22d ago
        Ohhh I see thanks!
  - 24d ago
kphorn 25d ago
https://youtu.be/4VrLQXR7mKU https://youtu.be/4VrLQXR7mKU “Um, I know this may be a very personal question, but is it possible that you…could we say…may be…a Robot?”
elric 25d ago
Constantly. It's made me stop using Google entirely because I can't run a single search without hitting reCAPTCHA. It's becoming problematic because some services I pay for, such as Bandcamp, also end up pestering me with boatloads of reCAPTCHAs. I enjoy Bandcamp, but I'm going to have to axe it if it keeps up.
dathinab 25d ago
works for me, with uBlock Origin enabled, one captcha solve was enough but .... my user agent is way more finger printable then it should (e.g. has the Linux x86_64 part) so that might make the difference.
wastedpotencial 25d ago
Since last month I've been CAPTCHAed in many Google searchs in Firefox. I assumed either a local device was spamming them or maybe Codex/Claude web search was flagging me as a bot. So is this CAPTCHAing because I refuse to navigate the ad-infested way? How can I rule out a problem on my end if my router is ISP provided with limited functionality ?
n4pw01f 25d ago
One interesting thing I found recently was after enforcing geo-fencing, recaptcha intermittently started failing. They might be using global edge servers or something
annon_00 25d ago
67
johnnyApplePRNG 25d ago
reCAPTCHA actually works for me. The one that asks if it's a sidewalk or a motorcycle or whatever right? cloudflare bot detection has convinced itself I am a bot however (I do a lot of automated web related stuff on my home IP) and that's been an eye opener for sure... I can't enjoy a good 20% of the internet it seems like now. Doesn't matter how many times I click that cloudflare button, they don't believe me. And I've been signed in to my cloudflare account (which I've held in good standing with a live credit card for years) the entire time :/
- sourweasel 24d ago
  Same experience for me. I get endless Cloudflare loops for many sites due to using less common browsers. Given that the goal is is distinguishing bots from actual humans, it seems to be a rather high failure rate. At least I think I'm human... One method that does seem to help is being sloppy when clicking the "I am a human" checkbox. I suspected that bots were more likely to perfectly click the center of the checkbox every time and decided to try clicking the padding around the checkbox instead (which still registers as a click). It seems to be more successful, but it could be my imagination.
  - johnnyApplePRNG 24d ago
    They are using every trick in the book, so I suspect your suspicions may be true.
jeroenhd 25d ago
Strict mode has always been broken for me. Firefox replaces some of Google's tracking scripts with no-ops but that usually breaks Google's reCAPTCHA on my end. I have to disable tracking protection to make reCAPTCHA sites work. I think it's fair for Google not to fix Firefox's shims, so I don't know who to blame for this. I doubt it's part of some big conspiracy against Firefox, though. I don't think Google cares enough about Firefox to bother annoying Firefox users. Archive.is has had downtime this weekend when I tried to use it. They also regularly pull shady stuff, so I wouldn't be surprised if they did something stupid again and got themselves banned from reCAPTCHA.
ck2 25d ago
I've found two things that sometimes allow me through either change the user-agent to the newest version for WINDOWS and/or use cloudflare warp which is technically a free non-privatizing VPN on linux you can use warp via wireguard + WGCF * reddit.com/r/CloudFlare/comments/ty9hke
high_na_euv 25d ago
Yes. For months it ocurres every time when I opened Google in private mode, then it stopped and recently appeared even on phone
omoikane 25d ago
I just tried and it doesn't happen for me, maybe the problem has already been fixed? Separately, if I were seeing a captcha that I can't get past, my first reaction would be to find a different site to see if it's a site specific issue, because some sites intentionally configure their captcha to work like that (e.g. you can't get in until you have been stuck solving captchas for at least a minute). I would see that more as a signal that the site operator is user hostile and not attribute it to a captcha provider.
howard941 24d ago
Yes, recaphca's become far more intrusive to this ff user
glub103011 24d ago
[dead]
dbg31415 24d ago
Total pain in the ass. Half the time "Sign in with Google" doesn't work from Firefox either. https://imgur.com/a/L5E5JgC https://imgur.com/a/L5E5JgC
unbolted3032 24d ago
Is anybody aware of any ad-block lists (for Pi-Hole or Adguard) that block all of Google's IP addresses? And Meta while I'm at it?
eMpHaSe 24d ago
Yeah, I am also a firefox user for years. I think, i will indead switch to Chrome in the next weeks...
weedfroglozenge 24d ago
Anyone fighting for the removal of CAPCHA's or complaining about picking motorcycles or bridges is a bot and should be removed from this website. As a human, I have no problem solving these. I don't think I'm particularly clever but I am human. Bot psyop?!
keks24 24d ago
Google does this for a long time already. You may want to use "Buster: Captcha Solver for Humans"[1], which uses the audio option to solve the CAPTCHA. There are even several speech recognition methods, like wit.ai, which is basically from Facebook: $ whois wit.ai | grep "Name Server" Name Server: b.ns.facebook.com Name Server: a.ns.facebook.com Name Server: c.ns.facebook.com Name Server: d.ns.facebook.com [1] https://github.com/dessant/buster https://github.com/dessant/buster
jerlendds 23d ago
Im usually on Firefox and I haven't run into this. But I also spent the past 2 days building a Knitsail VM solver in Rust for pulling Google Search results. Works nicely, I gave chatgpt pro (6) a minified JS bundle, and some variables and entries into the VM and told it to reconstruct the VM in Rust. Only took a couple hours to get a zip with a solver I could plug into my crawler, made a few mistakes but codex fixed those up with minimal guidance. No more Google captchas for me :)
tmpsvc2695f5 23d ago
[dead]
browserforest 22d ago
[flagged]

gruez 25d ago

>CAPTCHA for login should just be outright illegal How do you prevent credential stuffing attacks? >especially if it blocks important functionality like closing your account. That just falls under standard tort law, not to mention recent "click to cancel" legislation some states have been introducing.

JoshTriplett 25d ago
> How do you prevent credential stuffing attacks? CAPTCHAs don't work anymore, at this point. AI can trivially solve them. Rate-limit the number of attempts, test accounts against known-password lists like HIBP, and support 2FA.
- gruez 25d ago
  >CAPTCHAs don't work anymore, at this point. AI can trivially solve them. The point is to raise the cost, not to create some impenetrable barrier. A $5 vps can make hundreds of requests per second. IP bans and rate limiting forces people to use residential proxies, which are like $5/GB. That's much more expensive, but still cheap. Not sure about the token cost of AI is like, but captcha solving service used to charge around $0.002 per solve, which increases costs even more.
  - GoblinSlayer 25d ago
    For credential stuffing you need only one attempt.
    - gruez 25d ago
      No, it's a numbers game on both sides. Attackers are after hundreds or thousands of accounts, not just one. Defenders knows that exactly 0 hacks are impossible to achieve, and they're just trying to limit losses from fraud, but also costs from anti-fraud.
      - GoblinSlayer 24d ago
        They have so many accounts broken daily? Then credential stuffing attacks are not prevented.
    - olyjohn 24d ago
      Then you don't need to automate it, and you can just manually solve the captcha and log in.
  - bellowsgulch 24d ago
    There is no raised cost anymore. Every professional doing this work has perfect alignment with regular consumer heuristics. OS, browser, fingerprinting, networked bytes, residential address spaces. All of it is done.
- nisegami 25d ago
  >How do you prevent credential stuffing attacks? Passkeys or magic links seem like the way forward here.
  - hombre_fatal 25d ago
    You can also randomly generate a password for the user on the form they'd normally type one in on registration. Add a "Regen" button to give users more visceral control over it before they submit the form.
    - account42 24d ago
      That's essentially the same as magic links because most users won't remember/save that password and will have to rely on the usually email-based reset flow.
      - hombre_fatal 23d ago
        Sure, but this subset of user was going to otherwise reuse their password and be susceptible to cred-stuffing. The point is to stop the attack and prevent users from accidentally hosing themselves.
    - nisegami 24d ago
      Isn't that essentially a manual passkey?
  - JoshTriplett 24d ago
    Please don't. I find such services obnoxious, especially when they aggressively log you back out. Chasing down a link in your email is much slower than having your password manager fill in the long unique random password and hitting "log in".
    - nisegami 24d ago
      >Chasing down a link in your email is much slower than having your password manager fill in the long unique random password and hitting "log in". That's basically a passkey without its special API.
- vablings 24d ago
  Passkey only. No passwords no usernames just passkey
  - olyjohn 24d ago
    At the minimum, stop using goddamn email addresses for the login.
  - Plont 24d ago
    I'm not giving up recovery codes, nor my ability to default to locking out people who physically have my device. I usually don't allow auto-login or biometrics login either. If a website/app goes passkey only (or, even worse, if it starts relying only on one-time email codes), I won't use it. I know plenty of others who feel the same, though I don't know if we're numerous enough to put a dent in a company's bottom line or not. I imagine it depends on the company and its target audience.
    - vablings 23d ago
      Two passkeys. If you lose two then yeah, you are boned don't do that. They are absolutely the superior solution
iambenm 25d ago
Rate limiting
- hombre_fatal 25d ago
  Attacks have been distributed for quite some time if your service has any loot worth attacking. You have to handle the case where every request comes from a unique IP address.
toomuchtodo 24d ago
Passwordless and passkeys. There are no credentials to stuff. Login with magic link, email OTP, passkey, etc. Get rid of the password, rate limit what remains.
- Plont 24d ago
  Email OTP is garbage without the option to also add a password. That just outsources the problem to the user's email service, and assures that compromising the email inbox alone is enough to immediately also compromise every service that uses passwordless, 2FA-less "magic link" or OTP login. Email services don't even support true 2FA; many claim to, and ask for a 2FA code for web login, but connecting an email account to a client via POP or IMAP bypasses that.
  - toomuchtodo 24d ago
    I implement customer identity and access management for millions of users in financial services, based on requirements driven in part by US federal regulatory and cyber insurance requirements. What’s your experience? > Email services don't even support true 2FA; many claim to, and ask for a 2FA code for web login, but connecting an email account to a client via POP or IMAP bypasses that. "In less than a year, passkeys have been used to authenticate people more than 1 billion times across over 400 million Google Accounts. Passkeys are easy to use and phishing resistant, only relying on a fingerprint, face scan or a pin making them 50% faster than passwords. In fact, on a daily basis passkeys are already used for authentication on Google Accounts more often than legacy forms of 2SV, such as SMS one-time passwords (OTPs) and app based OTPs (such as Authenticator apps) combined." https://blog.google/innovation-and-ai/technology/safety-security/google-passkeys-update-april-2024/ https://blog.google/innovation-and-ai/technology/safety-secu... (April 2024) Don't forget: Microsoft is killing passwords. How to set up a Microsoft passkey before August deadline. - https://mashable.com/article/microsoft-passkey-how-to-password-deadline https://mashable.com/article/microsoft-passkey-how-to-passwo... - June 20th, 2025 (All major email providers support either passkeys, or in the case of Microsoft, passwordless ["strong authentication"]; we can consider the user creating an app specific secret for an external mail client minimal risk if performed after strong authentication has occurred, as the odds are low of that secret being phished or exfiltrated once configured in their mail client of choice, for the few folks interested in such a user experience with web based email services)