Transcript
A tumblr post saying "i really like this thing where websites will have separate “log in” & “sign up” buttons and if you click “log in” it takes you to a sign-up screen anyway so you have to click “i already have an account” and then it will ask if you want to sign in with your facebook account or with instagram or linkedin or deviantart or whatever, and if you choose “username & password” it asks if you want to put in your username or use your thumbprint, and once you put your username & password it emails you a confirmation code, and once you put in the code it says “do you want to give us your phone number for future sign-ins? do you want to sign up for facial recognition? do you want to give us your bones? give us your fucking bones?”
You must log in or # to comment.
In all seriousness, I’m hating this latest trend where you click the “login” button (page refresh 1) and they ask if you want to use a one time code or password, and I use a password manager like a functioning adult, so I click “password” (page refresh 2, could have already been logged in by now) and THEN I get to input my password (page refresh 3) and then they’re like “y’know what, we’re gonna send you a one-time code anyway” (page refresh 4) so I have to retrieve that and finally get to login on page FIVE.
We used to be a proper Internet.
Then the chucklefucks manage to have the worst backend security imaginable and all your data gets breached in a leak anyway but they make their security look really impressive to customers so for six glorious months they created Shareholder Value and the c-suite already took their golden parachutes.
Here, take this random string my password manager made
don’t forget the “install our app to make the next login faster” interstitial after you press “login”. can you really claim they don’t care about how painful their login process is when they’ve gone out of their way like that to provide you with a less painful option??
And whoever came up with the idea of putting email on one page and password on another: You suck.
I can never get my password manager to handle that proper. WTF is even the point?I came to the comments to post this exact complaint. I’m sure it’s considered more secure somehow, (maybe to prevent autofill attacks?) but at least code your fields properly so my password manager can auto detect the username field.
Also, phone number/ZIP code fields that pull up the full keyboard on mobile, instead of just the number pad. There’s no reason to show the entire keyboard, and phones have the ability to detect what kind of input the field wants… But website devs don’t bother coding their fields properly for numbers only, so the phone pulls up the full keyboard by default.
Lastly, 2FA fields that break paste. Like when it’s asking for a 6-digit TOTP code, and the field is actually broken up into two 3-digit fields instead.
countries with alphanumerical postal codes exist, so unless you are 100% sure, that your service won’t be used by someone from such a country, you’d better allow alphanumerical inputs in your postal code field. Addresses in general are tricky, because they work different across the globe, for example house numbers are not a thing everywhere, hell i am not sure if streetnames are a thing everywhere.
in the uk post codes have letters
Auto fill attacks is a weird way of saying password managers. You know. Those things that make it easier to use good password practices and be more secure.
I mean, there’s a reason browsers moved towards asking to autofill. Back when browsers would just do it automatically, there were malicious pages/ads that would hide fake username+password fields offscreen. So when the ad loaded, the browser would try to be helpful and would autofill the info. Then the ad would simply capture the autofilled info, and now your account is compromised.
Autofill attacks were so awful because the browser automatically did it without asking first. It was literally a zero-click drive-by attack that nabbed your info without any prompting or alerts on the user’s end. So to try and combat this, browsers moved towards requiring a prompt.
Tangentially, malicious ads then started using clipboard attacks instead. The ad would simply request your clipboard data, because there was a very good chance that it was your password. That’s why browsers stopped allowing sites to request clipboard data at all, and now it requires the user to actually push the data via a Ctrl+v instead; Anyone who has used Google Docs/Google Sheets will be able to tell you that Right Click>Paste doesn’t work, and it’s because the site isn’t allowed to request access to your system’s clipboard.
That’s all very interesting and insightful, but I don’t see how a site putting username and password entry on separate screens helps mitigate any of this, unless they’re doing something like showing ads on the page that asks for the username but not the one that asks for the password? I typically use ad blockers so I genuinely don’t know what’s standard. My gut feeling would but they don’t show ads on those pages at all. Apart from sites that have username and password boxes on the main page. But that’s still no reason to split the password from the username if both are on a dedicated page with no ads. I don’t see how it would prevent against fake password entry boxes either. Most of those sound like things the browser would ultimately need to mitigate against since any site could be compromised. Obviously sites have some role in it too.
KeePassXC lets you edit the auto-type for each individual password, so you can have it go
{USERNAME} {ENTER} {DELAY X} {PASSWORD} {ENTER}
x would be a number of milliseconds you may need for the next page to load in
Don’t trust any website that asks for your bones.
It’s secretly run by the rambling gambling skeletons. No one wants to play euchre anymore, so they had to take a different angle.
I once signed up and gave the website bone permissions.
When I realized my mistake I deleted my account immediately, but they got my shin bone.
Also shout out to front end js libraries that hijack and discard familiar default page rendering behavior in favor of asserting their own arbitrary, untrustworthy, and inferior render behaviors that break completely outside of chrome browser or with any extensions running, gotta be my least favorite gender.
Like how so many sites just fuckin come to a dead stop and reload completely if you click literally anything because the developer didn’t follow React design philosophy perfectly. Thanks a million, Facebook, so cool so cool.
deleted by creator
Do you want my facial recognition?
*Sobs in UK*
deleted by creator
You’re not actually giving the website access to your fingerprint or other biometric information by doing that. That’s all handled on your device which then sends a verification message.
I was confused recently at a border post marked “Passport control”. I had it ready, but the guard asked for my driving licence. While I was fishing for that he breathalysed me, which came back clean so he said I could go - without having seen either my passport or driving licence.
I believe it’s called enshittification
It’s shitty, but it’s not “enshittification”.
Doctorow’s explanation goes
Here is how platforms die: first, they are good to their users; then they abuse their users to make things better for their business customers; finally, they abuse those business customers to claw back all the value for themselves. Then, they die. I call this enshittification
What the OP describes is just obnoxious design. To be enshittification it should be a change from better UX to worse and the change should be an attempt by the site to grab some extra cash.
Twitter requiring an account to see replies to a tweet is an example–they’re trying to juice their user-count.
deleted by creator
Found my spirit animal.
Not as bad as the log in button taking you to the sign up page, but my local library’s site has a “log in” button that, when you click it, brings up “log in” and “sign up” options on a CSS drop down (though I’m sure they use javascript, just because why do it the easy, safe way). You literally have to click “log in” twice to get to the log in page.
the only one i trust with my bones is Slepp the Idol
What kind of website are those people using? 🥀
