This could be vibe coding, or just an intern “doing the web site”.
Neither should have write access to production code.
Assuming this is real, how the fuck do you fuck up so badly?
What!? It’s more user friendly this way. No need to make the user switch to a totally different when you can tell them right here!
/s
(I hate pointing out sarcasm, but it’s better not to risk it these days.)
Feels like testing feature, hopefully the screenshot isn’t from production.
We test in production, silly.
Everyone has a test environment. Some are just lucky enough to have a separate production environment.
It’s the only way to fly.
vs
That’s up there with: "You cannot use this password, it’s already in use by … "
But that’s so practical. Maybe I can contact them and ask them if we can swap. Haha
IIRC the screenshot in the tweet is from a shitpost in reddits r/badUIbattles
You’re absolutely right! It doesn’t make sense to show the user the 2fa code! removes 2fa completely
Oh, I get it! You still want 2fa, you just don’t want the code to be shown! colors the text white
No, no, make it ultra secure and display none it, every website will be a database of important information, you just have to put everything into a hidden table!!
Font size 0
Oh you want the code not rendered into html!
Drops the code in javascript when it is received from the backend.
Repost.
Just delay accepting the numbers for 10 seconds to simulate the time needed to check SMS and type them.
It took me way too long to figure out what was wrong with this screenshot
Yeah, same here. I was counting the boxes thinking they’d got the wrong amount of numbers.
I counted the boxes 3 times. :(
I need help. I don’t get it…
No point sending the code to your phone when it’s displayed right there. The idea of doing this is making sure nobody has stolen your password, because they still need access to your phone before they can access your account.
The “secret” code sent to your phone is spelled out in the text
Sike! That’s the wrong number! /s
It’s spelled “psych”, as in you’re psyching them out.
Nitpicking words like this makes me psich
It’s ok I’m oot of academia.
SMS/email-based 2FA should die.
It’s better than nothing and some people would really struggle to do other types of 2FA.
I’ll be homest with you, some people really struggle with email 2fa. The amount of working Americans I have spoken with who don’t understand how to have two tabs open at once is genuinely frightening.
As a reset method it’s worse than having nothing
Luckily, you don’t even need to check SMS or input a valid number with the “verification” in the screenshot!
mission failed successfully
What’s the best alternative?
App based 2FA is better. Either the app generates a time based code that you enter into the site or the site sends a push notification to the app asking you to verify the login attempt.
Passkeys are good too as they replace the password completely and leave the 2FA part to the device.
Okay, but then you have to develop an app
You don’t for the one time codes because there is a standard that is supported by many authenticator apps.
Passkey or notification please. So sick of entering these codes on a daily basis.
I just save the cookies tbh
If it’s alright with your threat model, you can put the time-based OTPs into your password manager of choice, like Bitwarden. Upon filling your username and password, it places your OTP in your clipboard, so that you can simply paste it in. This does of course reduce the security of the system slightly, since you centralize your passwords and your OTPs. When opting for this method, it is therefore imperative to protect your password manager even more, like via setting up 2FA for the password manager itself or making sure your account gets locked after something like 10 minutes of inactivity. The usability aspect is improved by using a yubikey or another similar physical key technology.
Very good point. I have Bitwarden set up as a passkey for at least one account. I should remove that. 👍
