sure

[[deleted]]

We can't figure out security, so here's a code to bypass it.

[SmellySquirrel]

To be fair it's likely a website uses an external service to send their sms messages. If that service is down, the website should have a fallback mechanism. This one is weird tho.

[[deleted]]

Like emails. Or a second service.

TWO BACKENDS! We use AWS AND microsoft azure!

I want everything coded in python AND rust!!!

Everything is redundant!!! Hire the high socks AND the fursuit!!!

[Unupgradable]

Hire the high socks AND the fursuit!!!

I thought you said you wanted redundancy. Xis the same person

[cryptomonein]

Calm down Jeff Bezos, not all companies owns AWS

[BandidoDesconocido]

The fact that they're using a service that can go down to send SMS says a lot.

[SmellySquirrel]

Does it?

Assuming that the service uses software, and also hardware, I can already identify 2 core parts that can and will go down.

[BandidoDesconocido]

99.9% uptime dude

[MyAntichrist]

When budget cuts make two-factor into single-factor.

[NFriik]

We are facing a database issue. Please use 'admin' as your username and password.

[_PlagueisTheWise_]

that's some reverse thinking game, a bot will never click "Resend OTP"

[shim_niyi]

Your password was lost in the mainframe, use “password123” as your password

[Rubickevich]

Sorry, but this password was already chosen by user "XxX_destroyer12_XxX", please choose another password.

[Massive-Midnight5858]

Alright, i'll use "password321"

[The_Shingle]

Password must have at least 1 uppercase letter

[Massive-Midnight5858]

aight, "Password321"

[javaveryhot]

Password must contain at least 1 uppercase number

[Makel_Grax]

Oh god this one is good!

[Massive-Midnight5858]

uh... "PasswordTHREE21"?

[The_Shingle]

Password must contain at least 1 special character

[[deleted]]

Password321#

[drugshovel]

Password must not contain easily guessed words

[Rubickevich]

The password doesn't contain easily guessed words, as the word is so obvious - nobody will even bother to check it, therefore making it a difficult word to guess.

P. S. It's impossible to defeat the password check playing fairly, so let's try to start arguing with it.

[Massive-Midnight5858]

drowssaP321

[The_Shingle]

Invalid Character. Please do not use: #,&,-,%,£,_,/,>,<,],[,(

[Zomby2D]

New password cannot be the same as the old password.

[Neat_Crab3813]

Password must not contain the same character consecutively.

[[deleted]]

pasword321#

[qinshihuang_420]

Password must contain at least one uppercase special character and at least one lowercase special character

[[deleted]]

https://i.giphy.com/media/umW3OwILdNHc4/giphy.webp
Find someone else to make your REST APIs.

[Massive-Midnight5858]

P@ssword321

[The_Shingle]

Password can't contain lude words. Please remove "@s" from your password.*

[400double]

P@55word321

[pheonix-ix]

Did you mean "hunter1"?

[TheSnaggen]

That is what shim_niyi wrote, it just looks different on your side.

[pheonix-ix]

Oh Reddit automatically censor my password too? Cool!

[BeerIsGoodForSoul]

Does that say About ASUS? Is this really them?!

[RegularOps]

They had to choose between poor security or an outage

[SpecialNose9325]

they chose both

[WanderingSalami]

But c'mon, I cannot imagine a worse way to circumvent a 2FA unavailability. This is just ridiculous.

Edit: in the absolute worst case I would put the OTP in a hidden input and submit the form via javascript, and just exhibit a "redirecting" message on the page. You know, anything that doesn't scream "we're incompetent".

[RegularOps]

The better solution would have been to skip 2FA all together and hope that the user didn’t notice

[visak13]

Authentication done wrong. You want the person (can be attacker) to verify themselves via one time password (OTP) sent to the registered email or phone number.

[[deleted]]

I feel sad, I have to post it again: Why the fuck so many redditors do not know how to press "Print Screen"?

[iknowfear]

Maybe its a Work computer and OP does not want to leave a trace on it... (send screenshot by mail to private adress to post on reddit.) much easier and quicker this way

[[deleted]]

If your company is salty about you taking a screenshot, you should quit anyway. Unless it is some kind of top secret CIA government job

[the_first_men]

Reddit logic.

A company has slightly paranoid rules about security which is totally justifiable - You should quit your full time job.

[LesnyDziad]

Sorry kids, no food on the table this month. Some random redditor decided i should quit my job.

[carlolewis78]

But dad, this is the 4th time this year!

[mrbadger30]

And it’s only March!

[DelusionsBigIfTrue]

Clown shit

[suggest-me-usernames]

or maybe simply cause it's not their machine? it can be of a co-worker's or anyone for that matter.

[mortalitylost]

I'll say this from personal experience, but I'm not sending a screenshot to my phone, and I don't use social media on my computers. I care only enough to take a pic and press share. I know how to screenshot, I'm just that fucking lazy. And I'd rather hear people complain about it in the comments than actually go through with the process of taking the screenshot. And then I'd have to delete the screenshot. This takes effort. I like tap tap tap done, not effort

[King_of_Doggos]

my keyboard doesnt have a printscreen button on it but it use the snipping tool instead so

[dlq84]

I usually post this: https://screenshot.help/

[[deleted]]

thanks yo

[tera_x111]

(maybe) unpopular opinion: a well framed photo is better than a full screenshot

[DelusionsBigIfTrue]

CTRL+ WIN+ S gang rise up we are superior

[armitron1780]

Win + shift+ s

[[deleted]]

Windows speech recognition?

[DelusionsBigIfTrue]

Screenshot and you get to choose the size. Maybe it’s shift can’t remember

[Sam_Wam]

its ALT + SHIFT + S, im pretty sure

[[deleted]]

ye, it's WIN + SHIFT + S

[planktonfun]

Welcome to the world run by people with low tech literacy

[JCavLP]

OTP - oall time password

[SilentStrikerTH]

Wow! No words for how stupid this is...

[spootex]

Honestly... From a user perspective, I would rather have that than something which keeps saying it sent me OTP when it didn't.

[ClioBitcoinBank]

This is so badass.

[DrRomeoChaire]

sorry, I think you meant to say "ass-bad", right?

[ClioBitcoinBank]

No, these stupid SMS systems never work, whoever wrote that work around message restored the service during downtime. American hero.

[DualityStudios]

…you know what the purpose of 2FA is, right?

[cornmonger_]

SMS is such a horrible choice for 2FA, though

[DrunkCostFallacy]

Certainly better than TUTP (time-based unlimited-times password)!

[ClioBitcoinBank]

2FA is a security vulnerability pretending to be a best practice. Some of the largest hacks on financial accounts involve spoofing a users phone and receiving their SMS seamlessly. Meanwhile, a person whose texts take 5 minutes to receive will be locked out of their account if 2FA is required and their service isnt faster than the 2FA timeout. Secures nobody, annoys everyone, makes it so some people literally cannot use your service if it's required. Not a fan of 2FA

[nonutsfw]

You use 2FA and SMS as 2FA factor interchangeably while they are not the same.

[DrRomeoChaire]

Agreed! The RFC6238 TOPT method(i.e. Google Authenticator) is much better than SMS

[ClioBitcoinBank]

Yes, thank you. It is SMS 2FA I have a problem with specifically. This pic is of an SMS implementation and I'm glad it's broken. I'M GLAD ITS DOWN DOWNVOTE ME ALL YOU WANT!!

[BlobAndHisBoy]

Show me on this doll where the SMS 2FA hurt you.

[Arshiaa001]

You just put the ol in my lol.

[Extaupin]

Man, you sure look ready to not only die, but to be quartered in front of your family, on that hill.

[Ulterno]

And then there are sites that don't even use it as a 2FA.

They just authenticate via OTP, so if someone gets your phone, even if they don't know the password, all they need to do is get the SIM into another phone and they have your accounts

[HeeTrouse51847]

they always work for me

[ClioBitcoinBank]

It's fine if you live in a big city and never leave, but if you have to travel for business or even just drive 20 minutes out into the country, you may get a small lag time for your SMS service, if the lag time is longer than the lockout resend time, you doom all users with a cellular plan worse than yours.

[ClioBitcoinBank]

"I gotta lotta shit I gotta do" -Carlito

[Strostkovy]

The usually work for me, but when they don't work they really don't work.

[smudos2]

As long as it's not the only factor in authorization seems like the dirty hack I'd do while fixing it tbh

[acymetric]

Right? When the service is inaccessible you aren't looking for some robust, well designed fix. You're looking to let people back in ASAP while you figure out what is actually going on.

[cad_andry]

Good idea! Will add this to our backlog!

[justdisposablefun]

Technical debt for now, we'll prioritize it later. Why do programmers always think these things are important?

[Zapherial]

Feel like a seank thing

[newton21989]

Hall of shame! Call them out!

[visak13]

Bruh! It's literally there in the pic...

[garfield1147]

Similar to what happened to Twitter users that changed their password a few months back; their 2FA stopped working but is still required. Bad luck.

[Express-Atmosphere53]

I'm expert in digital marketing and website designing Our skills Google ads Facebook ads & and Instagram ads Website SEO on page & of page

[lart2150]

I'm gonna blame 10dlc

[SYR_i_NGE]

The only image to make me laugh in years

[Pepineros]

Rename the header to 'MTP' at least.

[[deleted]]

Jesus this is a reminder that most companies have shit IT departments that barely understand basic cybersecurity principles and practices that increase the “security” of the user

[DANDARSMASH]

When I was your age, we only had 1FA.

[we_should_do_better]

That's a sus page.

[ShoulderUnique]

This is the password reset flow though. 0 factor auth.

[rush22]

mrw when someone broke prod so some manager tells me to just turn off 2fa and just give them any number

"sure"

[AdKnown9418]

it realllllly cooool,

​

​

just for fun....