Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Don’t Get Clever with Login Forms

bradfrost.com

Post reply on HN
Print view View original

11–20 of 520 posts

Re: Don’t Get Clever with Login Forms

#11

Post by argd678 »

My list:

1. Don’t have your website take a longer password than your mobile app and then not let correct passwords login inexplicably

2. Don’t break completely on valid passwords because there’s a char you didn’t expect, testing is a good thing in security critical code.

3. Don’t mess up MFA if you’re a financial app logging into a 3rd party bank for a user by trying to replay a token code

4. If you login to any 3rd party services on behalf of a user, support a method that doesn’t require asking the users for their password such as OAuth2

Re: Don’t Get Clever with Login Forms

#12

Post by jes »

Could web developers and password manager developers get together and develop a standard web API for authenticating with a website?

I want to specify a URL and have my password manager run a behind-the-scenes conversation with the website and, ultimately, drop me into the home page in a logged-in state.

Re: Don’t Get Clever with Login Forms

#13

Post by amaccuish »

8ytecoder wrote: post #6
amaccuish wrote: post #3

Earlier quoted context omitted.

That is quite useful however with some federated auth flows, where you just need the email to see where to send them for the actual auth (e.g. Office365 and SAML login), otherwise you'd needlessly be entering your password. I also much prefer it to the previous way e.g. Office365 worked, where once you'd tabbed away from the email box, they'd detect you needed to be redirected and send you off, whilst most people had…

Yeah, federated flows were my guess too. However, the password fields could have been present and hidden in the same page supporting both password managers and avoiding a page transition. And also the hundred other sites that don't need federated flows but think they need to copy this feature as well. Together it's annoying to hit password managers twice for every login.

> However, the password fields could have been present and hidden in the same page supporting both password managers and avoiding a page transition

But then you run the risk of your password of being submitted to the wrong portal no?

> And also the hundred other sites that don't need federated flows but think they need to copy this feature as well

Very true. It seems to be becoming increasingly prevalent :(

Re: Don’t Get Clever with Login Forms

#15

Post by lowercased »

tylerrobinson wrote: post #5
colinramsay wrote: post #2

There's been a recent tendency to split login forms into username/password over two screens as mentioned in this article. It's maddening. Password managers can't deal with this, unsurprisingly. I don't see the benefit this provides for anyone.

I can't argue with the lack of password manager support. But I know where Product is coming from on these approaches. Asking for an email address on its own screen allows the form to check whether you have an existing account or need to set up a new one. You avoid a link that says "Don't have an account, Register Here". Is it worth it? I suppose it's subjective. Maybe the designer thinks that is a good reduction in f…

> Maybe the designer thinks that is a good reduction in friction.

Maybe the designer should use the site as many of their users use it, and realize the inconvenience it causes people (broken password managers, bad browser experience in general, etc).

Re: Don’t Get Clever with Login Forms

#16

Post by toddsiegel »

cletus wrote: post #8

I would go further than this: don't get clever with logging in. Here's a list of "don't"s: - DON'T arbitrarily restrict my password from being too long - DON'T arbitrarily restrict me from using special characters - DON'T arbitrarily me require to use certain classes of characters (eg 1 uppercase, 1 lowercase and 1 number as a requirement; see https://xkcd.com/936/ ) - (this is a big one) DON'T TRY AND STOP ME PASTIN…

Your list is more valuable than OP's.

I find 1Password is generally good at working with "clever" login forms.

Re: Don’t Get Clever with Login Forms

#17

Post by amaccuish »

jes wrote: post #12

Could web developers and password manager developers get together and develop a standard web API for authenticating with a website? I want to specify a URL and have my password manager run a behind-the-scenes conversation with the website and, ultimately, drop me into the home page in a logged-in state.

> Could web developers and password manager developers get together and develop a standard web API for authenticating with a website?

There is, it's called HTTP basic.

But I guess you're meaning more form based login? Well most password boxes are fairly obvious from an HTML point of view already.

Re: Don’t Get Clever with Login Forms

#20

Post by zrail »

colinramsay wrote: post #2

There's been a recent tendency to split login forms into username/password over two screens as mentioned in this article. It's maddening. Password managers can't deal with this, unsurprisingly. I don't see the benefit this provides for anyone.

1Password handles this just fine. You just have to hit the button twice.
Post reply on HN