1037
These F-ing Logins Nowadays
(lemmy.nz)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 13 Nov 2026
1037 points (97.4% liked)
Programmer Humor
34135 readers
1937 users here now
Welcome to Programmer Humor!
This is a place where you can post jokes, memes, humor, etc. related to programming!
For sharing awful code theres also Programming Horror.
Rules
- Keep content in english
- No advertisements
- Posts must be related to programming or programmer topics
- If the mod doesn't find it funny, you're banned. Ha-ha!... For real: do not use the community for "statements". There are other places for such content. Keep it chill and funny.
founded 3 years ago
MODERATORS
What other 2FA methods are you looking for? I have seen a couple sites that will call you, but that is really just verbal text messaging.
The stay logged on and trust this system actions are probably controlled by a browser cookie, so won't work if you don't allow cookies from that site.
a magic link is not 2FA if it doesn't also require a password. it's 1FA, they just replaced the one factor.
honestly i really hate websites that do that and yet don't allow password-only 1FA. like sure, i understand that the average user's password discipline is crap, but as a power user i'd really like it if all my accounts weren't tied to all my other accounts sometimes.
Timed One Time Passwords (TOTP). It's what Google Authenticator and a lot of other 2FA apps use.
2FA auth codes, like Ente Auth, or Okta.
even if you clear your cookies, the session token id still exists for the website
Some websites treat the first login you ever done as a sort of root of trust, for example for account recovery they might ask if you can to verify it is you on that session
Some websites use the number of login sessions and how many recent times you have logged in for theie hidden trust factor, and some may even lockdown your account if it gets too low automaticly
everyone knows to clear their cookies but absolutely nobody thinks to clear their localStorage, sessionStorage, or indexedDB. i have never once in my life seen someone include those when telling someone else to "clear their cookies." even including cache in that list (e.g. using ctrl+shift+r to refresh the page instead of ctrl+r) is weirdly uncommon.
In my experience, they are. In my bowser, I have to explicitly allow the saving of site data if I hope to be able to keep myself logged in. For me, this is fine; I only want to stay logged in on a handful of sites anyway so the tradeoff between adding an exception for some sites vs. allowing every single site I visit to be able to save some piece of data doing god-knows-what (likely helping Facebook and the like track where it is I visit) on my machine is worth it.