- cross-posted to:
- programmerhumor@lemmy.ml
- cross-posted to:
- programmerhumor@lemmy.ml
You must log in or # to comment.
You’re absolutely right! It doesn’t make sense to show the user the 2fa code! removes 2fa completely
Oh, I get it! You still want 2fa, you just don’t want the code to be shown! colors the text white
No, no, make it ultra secure and display none it, every website will be a database of important information, you just have to put everything into a hidden table!!
*Includes it in the URL
Oh you want the code not rendered into html!
Drops the code in javascript when it is received from the backend.
It took me way too long to figure out what was wrong with this screenshot
Yeah, same here. I was counting the boxes thinking they’d got the wrong amount of numbers.
SMS/email-based 2FA should die.
Luckily, you don’t even need to check SMS or input a valid number with the “verification” in the screenshot!
mission failed successfully
It’s wild how standard SMS is given how (relatively) trivial it is to exploit.
Even with autofilling it on iOS, macOS you still have developers that need to fuck with form fields using JavaScript because they think they’re smarter than you.
What’s the best alternative?
TOTP, FIDO2 or not worrying about logins and just using {GitHub,Google,Microsoft,selfhosted.lan} as identity provider with OIDC
no factor authentication
IIRC the screenshot in the tweet is from a shitpost in reddits r/badUIbattles
Feels like testing feature, hopefully the screenshot isn’t from production.
We test in production, silly.
vs
It’s not like QA would’ve caught these problems before it went to production anyway
Everyone has a test environment. Some are just lucky enough to have a separate production environment.
It’s the only way to fly.
I will be honest, it took me a good while to figure out what’s wrong
Me too, but I woke up… Checks watch … 25 minutes ago, and I’m still pretty out of it.
Just delay accepting the numbers for 10 seconds to simulate the time needed to check SMS and type them.
Assuming this is real, how the fuck do you fuck up so badly?
What!? It’s more user friendly this way. No need to make the user switch to a totally different device when you can tell them right here!
/s
(I hate pointing out sarcasm, but it’s better not to risk it these days.)
(you don’t need to apologise for using tone tags, they’re a useful accessibility tool and hurt nobody)
When I first added 2fa to page, I had a bug and made it do that to compare the values.
production or test, it’s likely debug code.
New intern
i’m ashamed to say that took me a while to figure out what was wrong mostly because i didn’t think someone would be that dumb.
This could also be a funny translation issue.
My bank sends a text message to me with the first code and a second code I enter.
They tell me the first code in a similar way so I can verify they sent it to me, then I enter the other code in the text.
Repost.
