Or worse:

Use email link -> use password instead

Enter password

Now enter the code that we sent you your email...

The best I've seen was yesterday where a website had the log-in button greyed out after the password manager filled my creds in.
So I had to manually click both the email and password field. Just click them. Then it enabled the log-in button.
So someone took their time to write a piece of JS that said "If the user hasn't focused both fields at least once, no login". Literally why? Extra code that does nothing useful.

I was hoping passkeys would be the solution to this madness, but it seems to me the entire spec gives too much power to the OS Makers and too little to the users because "mUh AtTtEsTatIoN" so now I don't know anymore

HEY BUT DO YOU WANT TO USE A PASSCODE?? PASSCODE! PASSCODE! USE THE PASSCODE! -_-

Ah but you see it's one factor of authentication that also conveniently loops in whichever email provider is spying on you

God I hate those stupid magic links. They're WAAAAYYY slower than just using my password manager.

AND they kinda contribute to locking you into Big Tech. I sometimes have problems with those stupid links because I don't have a Gmail account. Somewhere along the stupid chain there's probably some stupid check that delays or blackholes emails to non-big-tech domains.

And then...

The password manager can't fill the form. You've got to change your 10-word, unique passphrase because it's 3 months old. And you have to verify with a text.

Oh and then you have to type it in on your TV with a remote and on-screen keyboard.

As an autistic person I felt this in my bones. I cannot STAND email based authentication.

I love FIDO logins and next to fucking no one implements them :(

Magic link is lazy 2fa.

Implement TOTP support, you lazy fucks.

My email uses greylisting which is where the first email received from a server gets a "busy" response - the idea being that spammers just fire and forget whereas real mailers will retry.

Unfortunately, some senders take so long to resend that it's timed out. The second time will work though. Unless they have multiple servers. Some have so many servers that you have to do this a multitude of times until you lose the will to login or forget what you were going to do anyway.

But you know what’s the safest way for us to keep your password safe? Not asking for one to begin with. By not creating a password with us you have no risk of it leaking, and we don’t have to deal with the responsibility of keeping it secure. The sign in link is going to your email, which presumably is protected with two-factor authentication, if you have it set up (which you should!).

https://www.404media.co/we-dont-want-your-password-3/

They had a follow up later too (paywall)

Recently finished a side project and I was glad I could go with pure login/pass auth. No email no oauth, just a pass phrase for account recovery. It's refreshing and so damn simple.

Password manager users living life on easy mode.

Just let me use passkeys at this point. The way that people typically use passwords is less secure anyway, why not just make it as simple as possible?

Also, those stupid annoying modern log in pages where it just asks for your email, then refreshes to a page with a password, because the password managers are hit and miss on detecting the log in form when it does that shit and why the fuck are we doing an extra step oage anyway????

It's over the phone, but the "We'll send you a text to confirm your identity if you provide a phone number." Has got to be one of the stupidest wastes of time.

Worst one I've seen: username and password plus a 2FA email, BUT if you hit enter instead of clicking the last button it refreshes the page.

Very few things on the internet and computer actually need accounts. Everything requiring a login is a cancer.

But if they don't get an active email and/or phone number.

How can they then turn around and sell that to info brokers and spammers.

Exactly

It feels like the factors of authentication discussion misses one important aspect: can the factor be replayed. Passwords can be replayed indefinitely, while the email links you get or the OTP token only work for a short period of time.

I remember it from the bad days when I used LastPass. Suddenly I got a notification that the place had been compromised and I had to suddenly change hundreds of passwords. 90% of them were for sites that didn't even exist any longer, but sifting through the long, long list to go change passwords was more work than I wanted to do.

Don't have to do that if I need to use a one-time token via Aegis or email! I do agree, though, that for low risk sites, username/password is totally fine.

I can imagine that the sites want to validate that you still have access to the email associated with the account, and asking people to check their settings is annoying, and they know no one will do it. I can also imagine that sites want to know as much about you as possible, don't want you to be using burner email addresses, and are probably selling the fact that your email address can still receive email to marketing firms who compile that info.

More people should use passkeys