this post was submitted on 10 Oct 2025
1284 points (99.5% liked)
Programmer Humor
27246 readers
2142 users here now
Welcome to Programmer Humor!
This is a place where you can post jokes, memes, humor, etc. related to programming!
For sharing awful code theres also Programming Horror.
Rules
- Keep content in english
- No advertisements
- Posts must be related to programming or programmer topics
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
SMS/email-based 2FA should die.
Luckily, you don't even need to check SMS or input a valid number with the “verification” in the screenshot!
mission failed successfully
It’s better than nothing and some people would really struggle to do other types of 2FA.
I'll be homest with you, some people really struggle with email 2fa. The amount of working Americans I have spoken with who don't understand how to have two tabs open at once is genuinely frightening.
As a reset method it's worse than having nothing
It's wild how standard SMS is given how (relatively) trivial it is to exploit.
Even with autofilling it on iOS, macOS you still have developers that need to fuck with form fields using JavaScript because they think they’re smarter than you.
What's the best alternative?
App based 2FA is better. Either the app generates a time based code that you enter into the site or the site sends a push notification to the app asking you to verify the login attempt.
Passkeys are good too as they replace the password completely and leave the 2FA part to the device.
Passkey or notification please. So sick of entering these codes on a daily basis.
If it's alright with your threat model, you can put the time-based OTPs into your password manager of choice, like Bitwarden. Upon filling your username and password, it places your OTP in your clipboard, so that you can simply paste it in. This does of course reduce the security of the system slightly, since you centralize your passwords and your OTPs. When opting for this method, it is therefore imperative to protect your password manager even more, like via setting up 2FA for the password manager itself or making sure your account gets locked after something like 10 minutes of inactivity. The usability aspect is improved by using a yubikey or another similar physical key technology.
Very good point. I have Bitwarden set up as a passkey for at least one account. I should remove that. 👍
Well, they're not a bad thing per se, it's just important to remember that by doing that you are essentially delegating the access security (including any means of MFA) from the target website to the password manager. I.e., instead of inputting password and 2FA code for example.com, you have to input your password and 2FA code for the password manager itself. This has the same security guarantees, so long as you don't set your vault to—for example—never lock automatically.
For the case of passkeys, using Bitwarden, even with 2FA does reduce the security level in my eyes somewhat, since I'd argue passkeys to be a more secure measure than password + OTP. Unless, of course, you use a different passkey to authenticate yourself to Bitwarden.
TLDR; be careful about putting everything inside Bitwarden. You'll be fine if you make sure to protect your password manager adequately, but if you put OTP secrets (or passkeys) for other website inside Bitwarden AND only use password authentication for Bitwarden without any MFA, then you are effectively reducing your MFA back to a single factor (the Bitwarden password).
I'm afraid user authentication on the internet is broken beyond salvation. It's already complex enough to grasp fully for tech-savvy people, meanwhile we've taught the general population to use password123 for all their accounts and write it on a post-it for a good measure.
I just save the cookies tbh
Aren't cookies invalidated after a while anyway? Doesn't seem viable to me.
After some time, yeah. Depends on the site.
And the browser saves those cookies for you, right? Throws them out when they expire.
I wonder if there are any TOTP apps for Linux phones (though I think I'll have to keep an Android or Apple device around for my workplace's 2FA which doesn't have anything for anything other than apple and Android phones, and only with full security)
Okay, but then you have to develop an app
You don’t for the one time codes because there is a standard that is supported by many authenticator apps.
TOTP, FIDO2 or not worrying about logins and just using {GitHub,Google,Microsoft,selfhosted.lan} as identity provider with OIDC