OAuth

all 86 comments

sorted by: hot top controversial new old
[–] 221 points 1 year ago (5 children)

Log in with caution

Carefully... CAREFULLY!

  • source
  • hideshow 5 child comments
  • [–] 42 points 1 year ago (4 children)

    clicks the Delete My Account Instead button

  • source
  • parent
  • hideshow 4 child comments
  • [–] 18 points 1 year ago (3 children)
  • [–] 24 points 1 year ago (1 child)

    More like, "are you sure?"

    Are you really sure?

    Okay, but, like, are you for real sure?

    Sure, just… confirm your password

    Confirmation code sent to your phone

    Now, log out and back in, to be sure

    You sure, right? Didn't change your mind?

    Okay, confirm link sent to email

    Okay, but, like, take a look at what you'll be missing. Are you really sure?

    Oi, I'll let you in on a secret: we got a very special deal, just for you. How about that? Sounds good, innit? How about we stop this silly thing and get back inside, so you can enjoy this sweet, sweet deal?

    Aight, get it. You hate good deals, and don't care missing out on what we have to offer. Please call us at 0118**************** and explain thoroughly why exactly you're leaving. Btw, can we get that written as well? Just, y'know, a little dissertation on the matter. Just mail it over to our headquarters

    Aight, just so you know, we'll have to charge a little account deletion fee. Standard procedure, here.

    Hate to see you go :(

    We'll miss you tons. Come back anytime!

    *marks account inactive*

  • source
  • parent
  • hideshow 1 child comment
  • [–] 103 points 1 year ago (5 children)

    I knew that potato would come in handy!

  • source
  • hideshow 5 child comments
  • [–] 76 points 1 year ago (1 child)
    [–] 68 points 1 year ago (2 children)

    My mom says its okay to login

  • source
  • hideshow 2 child comments
  • [–] 50 points 1 year ago (2 children)

    Honestly I thought it was great when OAuth started making it easy to use my various pre-existing IDs as logins for websites. But now I cant remember which one is which and my password manager doesn't give me any hints. Sigh.

  • source
  • hideshow 2 child comments
  • [–] 25 points 1 year ago (1 child)

    Honestly that’s why I just stick with local site auth and a password manager. 1) it lets me remember things via my manager and 2) if it’s compromised, they’ll only have access to that site and not other ones I’ve used to log in with.

  • source
  • parent
  • hideshow 1 child comment
  • I generally do too. But then you're also at the mercy of whether the site was designed with even the most basic of security in mind. Luckily the password managers all generate unique passwords so one site getting hacked and plaintext passwords stolen won't get my bank info put at risk - but still.

  • source
  • parent
  • [–] 34 points 1 year ago (1 child)

    somebody actually make an app where you log in with your calculator

  • source
  • hideshow 1 child comment
  • [–] 29 points 1 year ago

    It's not the funniest one, I don't have an account, and I don't live near one. But if I ever see the option to log in with Jollibee on any legit service I am already using I am switching over to that ASAP.

  • source
  • [–] 82 points 1 year ago (23 children)

    We're going to return to user + password in the near future.

  • source
  • hideshow 23 child comments
  • [–] 110 points 1 year ago (3 children)

    Please drink verification can to continue

  • source
  • parent
  • hideshow 3 child comments
  • [–] 41 points 1 year ago* (2 children)

    The code is at the bottom of the can and can only be seen be shining a flashlight down it. This completes Step 1 of the verification.

    Oh and it changes your pee color so it can reveal the passkey pisskey verification QR code on the urinal in front of you to complete Step 2 of the verification.

  • source
  • parent
  • hideshow 2 child comments
  • load more comments (1 reply)
  • [–] 24 points 1 year ago (16 children)
  • [+] 34 points 1 year ago* (last edited 1 year ago) (16 children)
  • [–] 30 points 1 year ago (3 children)

    Half a cryptographic key that you can't easily give to someone over the phone by accident.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 4 points 1 year ago (2 children)

    By convention. See for example: https://github.com/keepassxreboot/keepassxc/issues/10407

    We’ve had certificate authentication (backed by hardware) for ages. We could fix the UX there and be done with it, but nooooo, we are reinventing everything again. (Tangentially related: JWT, OIDC and SAML are basically kerberos with extra steps.)

  • source
  • parent
  • hideshow 2 child comments
  • [–] 2 points 1 year ago (1 child)

    I've been using certificate based auth on https for ages on my ops stuff. Most devices support just slapping an SSL/TLS key into their os, but not everything.

    But when I wanted to use it for Jellyfin, I found TVs and sticks aren't all straightforward.

    In your link, they closed that ticket as not planned because they intend to implement FIDO's secure exchange protocols. https://github.com/keepassxreboot/keepassxc/issues/11363

    It should (hopefully) be secure when they get done.

  • source
  • parent
  • hideshow 1 child comment
  • I mean, the passkey is still in there. It’s protected by convention. It’s a bearer token wrapped in a password manager, presented as a revolution.

    We have the technology, can we please pour the same amount of resources into what we’ve already had for decades? Passkeys solve the UX issue for ”normal people”, that’s the selling point.

  • source
  • parent
  • [–] 18 points 1 year ago (8 children)

    a very long password that (ideally) is only bound to a single device, requires a second identifier (biometric, PIN, password) and that is phishing resistant.

  • source
  • parent
  • hideshow 8 child comments
  • [+] 19 points 1 year ago* (last edited 1 year ago) (6 children)
  • [–] 19 points 1 year ago

    Bitwarden has been working great with me as sits transition to passkeys, even big corporate ones.

    But yeah in practice, google and facebook are going to probably dominate because they are the easy + free option.

  • source
  • parent
  • [–] 13 points 1 year ago (2 children)

    KeepassXC supports passkeys as well.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 5 points 1 year ago* (1 child)

    thus rendering them redundant, because their strength is being bound to a single physical device. if they're portable, they're as good as asymmetric key pairs.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 8 points 1 year ago

    Their strength is being half a cryptographic key, not that they’re device bound.

    That was a “requirement” that big tech wanted, to force you to be dependent on TPM storage, so you’d be forced to use a Trusted(tm) device and OS. It was made optional after pushback from basically everyone else.

    Password managers support Passkeys now. Bitwarden and KeePassX among others.

    As long as I trust that my password manager is secure, and as long as I use a strong master password or (better) have a hardware key to unlock it, it is way more secure than a password, and I can still install Linux without losing my logins.

  • source
  • parent
  • [–] 2 points 1 year ago (1 child)

    that's not the point, passkeys are not vendor centric, they are a standard. you don't want to duplicate a passkey for the same reason you don't want to copy an SSH private key on multiple devices. it's a security feature that allows disabling the account access in case the device becomes compromised (lost, stolen, infected, etc.)

  • source
  • parent
  • hideshow 1 child comment
  • load more comments (-1 replies)
  • [–] 3 points 1 year ago (1 child)

    i refuse to give my phone my thumbprint or do a face unlock. i'm not sure if it's still collecting a biometric bullshit on my face, but i have not done it myself. I'm a luddite here and i insist on it so no one (especially no one trying to violate the united states 4th amendment) can get into my phone without my permission or hacking into it.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 2 points 1 year ago* (last edited 1 year ago)

    i refuse to give my phone my thumbprint or do a face unlock. i'm not sure if it's still collecting a biometric bullshit on my face, but i have not done it myself.

    Then get a Yubikey. Replace “something you are” with “something you have”. It’s not ideal to have two somethings you have as your two factors, but a password to get into the computer to get to the passkey adds an extra layer that makes me comfortable with it.

    I'm a luddite here and i insist on it so no one (especially no one trying to violate the united states 4th amendment) can get into my phone without my permission or hacking into it.

    In the context of this discussion, it’s one of two factors. But I agree with you when it’s the only factor.

  • source
  • parent
  • load more comments (-1 replies)
  • [–] 4 points 1 year ago* (last edited 1 year ago) (2 children)

    Ooh-la-la, someone's gonna get laid in college.

    Edit: This is a joking reference from a Rick and Morty episode (S02E06).

  • source
  • parent
  • hideshow 2 child comments
  • [–] 0 points 1 year ago

    You forgot, you descended into the lemmy-verse powering your car where the concept of Rick and Morty humor is not appreciated and often not tolerated.

    ;)

    WUBBU-LUBBA-DUB-DUB!!!!!!!!

  • source
  • parent
  • load more comments (-1 replies)
  • load more comments (-1 replies)
  • [–] 23 points 1 year ago (3 children)

    Surely, potato won't sell my data, right?

  • source
  • hideshow 3 child comments
  • [–] 4 points 1 year ago (2 children)

    No but it expires every 30 days and you need to plant it and grow a new potato before you can log in again

  • source
  • parent
  • hideshow 2 child comments
  • [–] 39 points 1 year ago (5 children)
  • [–] 15 points 1 year ago (4 children)

    Why can't i see your password?

  • source
  • parent
  • hideshow 4 child comments
  • [–] 19 points 1 year ago (3 children)
  • Login with your mom 👩‍🦳

  • source
  • [–] 16 points 1 year ago (6 children)
  • [–] 12 points 1 year ago (2 children)

    What's more american than ordering a tray of spaghetti from a fried chicken restaurant?

  • source
  • parent
  • hideshow 2 child comments
  • [–] 16 points 1 year ago

    Always pick login with calculator, and spoof someone else's id.

  • source
  • [–] 15 points 1 year ago

    Login with a solemn promise

  • source
  • [–] 30 points 1 year ago

    One more reason for me to make an OnlyFans

  • source
  • [–] 10 points 1 year ago (2 children)
  • [–] 10 points 1 year ago
    [–] 9 points 1 year ago

    Form 137, nice.

  • source
  • [–] 8 points 1 year ago

    Ugh. Moooooooooooooom. I need you to login again

  • source
  • I'm logging in with a potato!

  • source
  • [–] 6 points 1 year ago

    totally possible, given you can digitally sign PDFs.

  • source
  • [–] 6 points 1 year ago

    Bestest quality

  • source
  • [–] 6 points 1 year ago

    I'll take the XL Pancit Canton, please.

  • source
  • [–] 3 points 1 year ago

    Can i login with your mom?

  • source
  • [–] 2 points 1 year ago

    Mmmmm... Caldereta...

  • source
  • [–] 2 points 1 year ago

    Use potato to get root access

  • source
  • [–] 1 point 1 year ago