Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bypassing Browser Security Warnings with Pseudo Password Fields

troyhunt.com

Post reply on HN
Print view View original

61–70 of 127 posts

Re: Bypassing Browser Security Warnings with Pseudo Password Fields

#61

Post by notheguyouthink »

Xeoncross wrote: post #54
acdha wrote: post #50

Earlier quoted context omitted.

It's not an opinion or unrelated but an analogy to another case where there's very strong evidence of a massive benefit with very little downside which is being objected to based on conspiracy theories and lack of concern for the damage to anyone foolish enough to believe them.

As a side note, the debate is not that simple. Vaccines work, but many vaccines are manufactured without what many would consider proper testing, and using toxic substances banned in different countries. The debate is more about sloppy implementations than about the idea of vaccines as a whole. It's like someone is forcing the issue down to choosing poorly-regulated vaccines - or no vaccines at all. A false dichotomy…

> The debate is more about sloppy implementations than about the idea of vaccines as a whole. It's like someone is forcing the issue down to choosing poorly-regulated vaccines - or no vaccines at all. A false dichotomy

This actually goes quite strongly against what I've observed though. Literally all of the anti-vaxxers I've met are 100% against vaccines. They are not vaccinated, nor are their children.

They're not doing research and choosing to use some vaccines but not others. They're completely ignoring all vaccines.

Re: Bypassing Browser Security Warnings with Pseudo Password Fields

#62

Post by uitgewis »

vilmosi wrote: post #52
maweki wrote: post #27

Earlier quoted context omitted.

yeah. The :empty() pseudoclass should do the trick.

:empty is for elements with no children, not empty value.

You could potentially use the validation rules, and set a min length of 1.

Re: Bypassing Browser Security Warnings with Pseudo Password Fields

#63

Post by Xeoncross »

acdha wrote: post #58
Xeoncross wrote: post #54

Earlier quoted context omitted.

As a side note, the debate is not that simple. Vaccines work, but many vaccines are manufactured without what many would consider proper testing, and using toxic substances banned in different countries. The debate is more about sloppy implementations than about the idea of vaccines as a whole. It's like someone is forcing the issue down to choosing poorly-regulated vaccines - or no vaccines at all. A false dichotomy…

> As a side note, the debate is not that simple. Vaccines work, but many vaccines are manufactured without what many would consider proper testing, and using toxic substances banned in different countries. Those are big claims without any supporting evidence. From the sounds of it, you're repeating the anti-vax claims about mercury.

Ethyl vs Methyl mercury is one of the most popular debates (because mercury is scary!). Most vaccines switched to Thiomersal which has ethylmercury in it. However, even ethylmercury crosses the blood-brain barrier. Other 2 big ingredients are formaldehyde and aluminum. From there you have to get more specific about which vaccine you are talking about.

Re: Bypassing Browser Security Warnings with Pseudo Password Fields

#64

Post by 3pt14159 »

metilda wrote: post #24
seasonalgrit wrote: post #22

Earlier quoted context omitted.

"the HTTPS and IPv6 anti-vaxxer crowd " What does this mean?

Pretty sure that means people who refuse to deploy TLS & IPv6, even when their hardware & software stack fully supports it.

There are situations where you need IPv4 due to rate-limiting. So while my stack technically supports IPv6 I have no reason to migrate to it.

Re: Bypassing Browser Security Warnings with Pseudo Password Fields

#65

Post by acdha »

Xeoncross wrote: post #63
acdha wrote: post #58

Earlier quoted context omitted.

> As a side note, the debate is not that simple. Vaccines work, but many vaccines are manufactured without what many would consider proper testing, and using toxic substances banned in different countries. Those are big claims without any supporting evidence. From the sounds of it, you're repeating the anti-vax claims about mercury.

Ethyl vs Methyl mercury is one of the most popular debates (because mercury is scary!). Most vaccines switched to Thiomersal which has ethylmercury in it. However, even ethylmercury crosses the blood-brain barrier. Other 2 big ingredients are formaldehyde and aluminum. From there you have to get more specific about which vaccine you are talking about.

You still haven’t specified your claims. Which vaccines aren’t well tested? Which substances are included at levels known or suspected to be toxic, and by whom?

Re: Bypassing Browser Security Warnings with Pseudo Password Fields

#66

Post by Xeoncross »

acdha wrote: post #65
Xeoncross wrote: post #63

Earlier quoted context omitted.

Ethyl vs Methyl mercury is one of the most popular debates (because mercury is scary!). Most vaccines switched to Thiomersal which has ethylmercury in it. However, even ethylmercury crosses the blood-brain barrier. Other 2 big ingredients are formaldehyde and aluminum. From there you have to get more specific about which vaccine you are talking about.

You still haven’t specified your claims. Which vaccines aren’t well tested? Which substances are included at levels known or suspected to be toxic, and by whom?

My claim is about the debate itself, not about any certain vaccine or danger.

Re: Bypassing Browser Security Warnings with Pseudo Password Fields

#67

Post by deckar01 »

js2 wrote: post #46
deckar01 wrote: post #33

This hack is exactly what I needed 2 days ago while working on a browser-based terminal app. My site will be secured with SSL/TLS, but I needed a way to make a content-editable span mask input like a password field. I already implemented it with a password input, but it doesn't wrap inline like a span does. It will be much cleaner to just add a class that masks the font.

A password field does more than just mask input. At least on macOS, it's also a secure input field where the OS ensures no other applications can see what is entered. Simply masking the font will imply to the user that their input is secure, when in fact it is not.

That is a good reason to keep using a password input. I should probably intercept the keypress events and show nothing so that the password never even reaches the DOM. Then I wouldn't have to worry about the input growing/wrapping.

Re: Bypassing Browser Security Warnings with Pseudo Password Fields

#68

Post by acdha »

josteink wrote: post #43
jakub_g wrote: post #37

Earlier quoted context omitted.

I don't want my ISP to inject JavaScript to random pages or analyze my traffic. That should be downright illegal. They should be like water supply company: provide me damn clean water and get out of my way. Somehow the sewage company doesn't analyze my urine (I hope ) to figure out if I prefer spicy or sour food and get an extra buck from third parties, and somehow they're still in the business .

> I don't want my ISP to inject JavaScript to random pages or analyze my traffic. I haven't seen a single reputable ISP do this anywhere. It would illegal. Is the US really such a third world nation that not even basic regulation like this exist?

If you run a JavaScript error collector or use CSP on a public site you’ll find this all over the world.

Mobile ISPs inject horrible 90s JavaScript which recompresses images (see e.g. https://calendar.perfplanet.com/2013/mobile-isp-image-recomp...).

Many ISPs - both mobile and wired - inject code to send messages about your account.

ISPs like Comcast have tried objecting ads:

https://www.infoworld.com/article/2925839/net-neutrality/cod...

https://arstechnica.com/tech-policy/2013/04/how-a-banner-ad-...

After leaving Mozilla, Andreas Gal described ISPs reselling search engine queries and results to Google competitors:

https://andreasgal.com/2015/03/30/data-is-at-the-heart-of-se...

Re: Bypassing Browser Security Warnings with Pseudo Password Fields

#70

Post by acdha »

Xeoncross wrote: post #66
acdha wrote: post #65

Earlier quoted context omitted.

You still haven’t specified your claims. Which vaccines aren’t well tested? Which substances are included at levels known or suspected to be toxic, and by whom?

My claim is about the debate itself, not about any certain vaccine or danger.

So far you're following the anti-vax script perfectly: lots of FUD, no claims specified in enough detail to even evaluate them much less counteract the overwhelming evidence that vaccines are a public good with no reputable downside.
Post reply on HN