• lemmyknow@lemmy.today
          link
          fedilink
          arrow-up
          22
          ·
          1 day ago

          More like, “are you sure?”

          Are you really sure?

          Okay, but, like, are you for real sure?

          Sure, just… confirm your password

          Confirmation code sent to your phone

          Now, log out and back in, to be sure

          You sure, right? Didn’t change your mind?

          Okay, confirm link sent to email

          Okay, but, like, take a look at what you’ll be missing. Are you really sure?

          Oi, I’ll let you in on a secret: we got a very special deal, just for you. How about that? Sounds good, innit? How about we stop this silly thing and get back inside, so you can enjoy this sweet, sweet deal?

          Aight, get it. You hate good deals, and don’t care missing out on what we have to offer. Please call us at 0118**************** and explain thoroughly why exactly you’re leaving. Btw, can we get that written as well? Just, y’know, a little dissertation on the matter. Just mail it over to our headquarters

          Aight, just so you know, we’ll have to charge a little account deletion fee. Standard procedure, here.

          Hate to see you go :(

          We’ll miss you tons. Come back anytime!

          *marks account inactive*

      • Gork@sopuli.xyz
        link
        fedilink
        arrow-up
        36
        ·
        edit-2
        1 day ago

        The code is at the bottom of the can and can only be seen be shining a flashlight down it. This completes Step 1 of the verification.

        Oh and it changes your pee color so it can reveal the passkey pisskey verification QR code on the urinal in front of you to complete Step 2 of the verification.

        • Cevilia (she/they/…)@lemmy.blahaj.zone
          link
          fedilink
          English
          arrow-up
          4
          ·
          15 hours ago

          That pings your phone, you confirm that, which dispatches a dermatologist to your location to confirm your identity via birthmark. She hands you the frequency of a unique Chilean numbers station, you tune in to that and it reads off the one-time passcode you can use to login.

        • MML@sh.itjust.works
          link
          fedilink
          arrow-up
          11
          ·
          21 hours ago

          It costs the company millions a year but at least no poor person gets anything for free.

        • rumba@lemmy.zip
          link
          fedilink
          English
          arrow-up
          27
          ·
          1 day ago

          Half a cryptographic key that you can’t easily give to someone over the phone by accident.

        • Pasta Dental@sh.itjust.works
          link
          fedilink
          arrow-up
          20
          arrow-down
          1
          ·
          1 day ago

          a very long password that (ideally) is only bound to a single device, requires a second identifier (biometric, PIN, password) and that is phishing resistant.

          • ☂️-@lemmy.ml
            link
            fedilink
            arrow-up
            16
            arrow-down
            3
            ·
            1 day ago

            bound to a single device

            yay vendor lock in. google or meta password manager salivating.

            • Pasta Dental@sh.itjust.works
              link
              fedilink
              arrow-up
              2
              ·
              16 hours ago

              that’s not the point, passkeys are not vendor centric, they are a standard. you don’t want to duplicate a passkey for the same reason you don’t want to copy an SSH private key on multiple devices. it’s a security feature that allows disabling the account access in case the device becomes compromised (lost, stolen, infected, etc.)

            • Zink@programming.dev
              link
              fedilink
              arrow-up
              18
              ·
              1 day ago

              Bitwarden has been working great with me as sits transition to passkeys, even big corporate ones.

              But yeah in practice, google and facebook are going to probably dominate because they are the easy + free option.

              • lime!@feddit.nu
                link
                fedilink
                English
                arrow-up
                7
                arrow-down
                4
                ·
                edit-2
                1 day ago

                thus rendering them redundant, because their strength is being bound to a single physical device. if they’re portable, they’re as good as asymmetric key pairs.

                • 4am@lemmy.zip
                  link
                  fedilink
                  arrow-up
                  9
                  ·
                  1 day ago

                  Their strength is being half a cryptographic key, not that they’re device bound.

                  That was a “requirement” that big tech wanted, to force you to be dependent on TPM storage, so you’d be forced to use a Trusted™ device and OS. It was made optional after pushback from basically everyone else.

                  Password managers support Passkeys now. Bitwarden and KeePassX among others.

                  As long as I trust that my password manager is secure, and as long as I use a strong master password or (better) have a hardware key to unlock it, it is way more secure than a password, and I can still install Linux without losing my logins.

              • ☂️-@lemmy.ml
                link
                fedilink
                arrow-up
                2
                ·
                1 day ago

                i’m assuming most people will use the default, which will probably be google lock in anyway.

          • Kaiserschmarrn@feddit.org
            link
            fedilink
            arrow-up
            9
            ·
            1 day ago

            bound to a single device

            Bitwarden let’s you sync your passkeys between devices. And you can also unlock your vault with one stored on a physical security key.

          • BeeegScaaawyCripple@lemmy.world
            link
            fedilink
            arrow-up
            2
            ·
            23 hours ago

            i refuse to give my phone my thumbprint or do a face unlock. i’m not sure if it’s still collecting a biometric bullshit on my face, but i have not done it myself. I’m a luddite here and i insist on it so no one (especially no one trying to violate the united states 4th amendment) can get into my phone without my permission or hacking into it.

            • humorlessrepost@lemmy.world
              link
              fedilink
              English
              arrow-up
              1
              ·
              edit-2
              20 hours ago

              i refuse to give my phone my thumbprint or do a face unlock. i’m not sure if it’s still collecting a biometric bullshit on my face, but i have not done it myself.

              Then get a Yubikey. Replace “something you are” with “something you have”. It’s not ideal to have two somethings you have as your two factors, but a password to get into the computer to get to the passkey adds an extra layer that makes me comfortable with it.

              I’m a luddite here and i insist on it so no one (especially no one trying to violate the united states 4th amendment) can get into my phone without my permission or hacking into it.

              In the context of this discussion, it’s one of two factors. But I agree with you when it’s the only factor.

        • nearhat@lemmy.zip
          link
          fedilink
          arrow-up
          5
          arrow-down
          2
          ·
          edit-2
          1 day ago

          Ooh-la-la, someone’s gonna get laid in college.

          Edit: This is a joking reference from a Rick and Morty episode (S02E06).

          • rumba@lemmy.zip
            link
            fedilink
            English
            arrow-up
            1
            ·
            2 hours ago

            You forgot, you descended into the lemmy-verse powering your car where the concept of Rick and Morty humor is not appreciated and often not tolerated.

            ;)

            WUBBU-LUBBA-DUB-DUB!!!

          • ☂️-@lemmy.ml
            link
            fedilink
            arrow-up
            2
            ·
            1 day ago

            i don’t get what this has to do with college, or getting laid at all but sure.

            • nearhat@lemmy.zip
              link
              fedilink
              arrow-up
              2
              ·
              1 day ago

              Oh, I’m sorry. It’s a reference to a Rick and Morty episode. I thought that’s what you were referring to.

  • Zink@programming.dev
    link
    fedilink
    arrow-up
    28
    ·
    1 day ago

    It’s not the funniest one, I don’t have an account, and I don’t live near one. But if I ever see the option to log in with Jollibee on any legit service I am already using I am switching over to that ASAP.

  • wetbeardhairs@lemmy.dbzer0.com
    link
    fedilink
    arrow-up
    45
    ·
    1 day ago

    Honestly I thought it was great when OAuth started making it easy to use my various pre-existing IDs as logins for websites. But now I cant remember which one is which and my password manager doesn’t give me any hints. Sigh.

    • ramble81@lemmy.zip
      link
      fedilink
      arrow-up
      21
      ·
      1 day ago

      Honestly that’s why I just stick with local site auth and a password manager. 1) it lets me remember things via my manager and 2) if it’s compromised, they’ll only have access to that site and not other ones I’ve used to log in with.

      • wetbeardhairs@lemmy.dbzer0.com
        link
        fedilink
        arrow-up
        5
        ·
        1 day ago

        I generally do too. But then you’re also at the mercy of whether the site was designed with even the most basic of security in mind. Luckily the password managers all generate unique passwords so one site getting hacked and plaintext passwords stolen won’t get my bank info put at risk - but still.