Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Don’t Get Clever with Login Forms

bradfrost.com

Post reply on HN
Print view View original

121–130 of 520 posts

Re: Don’t Get Clever with Login Forms

#121

Post by Scooty »

colinramsay wrote: post #2

There's been a recent tendency to split login forms into username/password over two screens as mentioned in this article. It's maddening. Password managers can't deal with this, unsurprisingly. I don't see the benefit this provides for anyone.

The few times I've seen this (Google and Amazon I think), my password manager (Lastpass) has had no problem, but I've run into several sites where simple two input and a button login forms don't autofill correctly. Usually the username field will get cleared when the password gets autofilled, so I have to manually paste the username.

I wish password managers would become popular with non-tech people already. I can't wait for a day where there's just a "Sign in manually" link for the few people that manage to remember their 1200 usernames/passwords. Password managers shouldn't need to rely on autofilling inputs at all.

Re: Don’t Get Clever with Login Forms

#122

Post by wccrawford »

dontbenebby wrote: post #111
jakelazaroff wrote: post #100

Earlier quoted context omitted.

What's the benefit of doing it that way?

I've seen some CVEs where malicious websites induce your browser to autofill (basically steal passwords). So the intention is that I stop some script from siphoning my passwords. This admittedly opens me up to phishing, but to mitigate I also have containers set up for various facets of my life. (So it's a big red flag if what's supposedly my bank doesn't open in the "bank" container".) Edit: I also value storing the…

That's why you should turn off auto-fill.

Re: Don’t Get Clever with Login Forms

#123

Post by mikewhy »

sonnyblarney wrote: post #50

Modality is ok. The reason being, a 'login' is often an interruption to the normal flow of experience. Trying to do 'A' then 'B' - need to login for 'B'. This is why modals exist. The background to the modal gives the context to 'where the login is happening'. If there is no context then it can have it's own screen. The absolute worst is when you're doing a bunch of stuff, you login, and the app does not forward you…

Agreed. Modality isn't bad. The author's concerns about them can be boiled down to "make sure your login form has a URL".

Re: Don’t Get Clever with Login Forms

#124

Post by CM30 »

jakelazaroff wrote: post #100
dontbenebby wrote: post #88

Earlier quoted context omitted.

>Password managers can't deal with this, unsurprisingly Maybe I'm overly paranoid but I choose to manually copy my passwords out of my manager into the login form. Then again I also use a PW manager that doesn't support cloud storage. (Though you could always throw your DB into Dropbox if you desired)

What's the benefit of doing it that way?

Makes you use the password manager credentials to access your login credentials for other services. Works to stop nosy coworkers, siblings, spouses, etc.

Re: Don’t Get Clever with Login Forms

#125

Post by wccrawford »

Casseres wrote: post #62
Solvitieg wrote: post #34

Earlier quoted context omitted.

My biggest one is... Requiring users to login with a username or customer id. (instead of email).

My biggest (related) one is… In the sign-up process, validate the email (don't trust the user). I get a lot of emails that companies never validated, including for a while, from Wells Fargo.

I was getting insurance claim information from a large company in another state for a while. I finally made a big enough stink that they took my email off the account.

And yeah, I'm sure it was the real company and not some phishing emails.

Re: Don’t Get Clever with Login Forms

#126

Post by FabHK »

MichaelDickens wrote: post #106
Apylon777 wrote: post #63

The worst offender I have seen in the wild is treasurydirect.gov. The password must be click in on an online keyboard, and they do not allow password managers to enter the passwords. Screenshot here: https://en.m.wikipedia.org/wiki/TreasuryDirect

It's actually even worse than that: they keys on the virtual keyboard are displayed in a random order instead of QWERTY.

Well, that's better though. So even if there's a key logger and mouse click recorder on your machine, one cannot recover your password. Though, if your machine is that compromised, might as well have a screen recorder, too. Though that would create more outgoing traffic.

Re: Don’t Get Clever with Login Forms

#127

Post by FabHK »

guitarbill wrote: post #93
argd678 wrote: post #11

My list: 1. Don’t have your website take a longer password than your mobile app and then not let correct passwords login inexplicably 2. Don’t break completely on valid passwords because there’s a char you didn’t expect, testing is a good thing in security critical code. 3. Don’t mess up MFA if you’re a financial app logging into a 3rd party bank for a user by trying to replay a token code 4. If you login to any 3rd…

5. Don't force password rotations. 6. Don't force me to use certain character classes if my password is long enough and therefore entropic enough without them. Special characters suck and are inconsistently supported.

Yes and yes... How come huge institutions can't follow password best practices?

Re: Don’t Get Clever with Login Forms

#128

Post by frosted-flakes »

mises wrote: post #32
davidwitt415 wrote: post #30

Imo one key point is missing: Don't give users the option authenticate via Google or Facebook. While it may be convenient at signup, it creates an unneeded dependency and confusion if you forget how you log into a certain site.

Lots of dev tools do this with github, too. The idea of a web-wide sso is a bad one.

In that case, I don't mind, since that dev tool probably has access to my GitHub account anyway. Like Netlify, which automatically re-deploys the site when the watched repo+branch is updated.

Re: Don’t Get Clever with Login Forms

#129

Post by [deleted] »

dontbenebby wrote: post #88
colinramsay wrote: post #2

There's been a recent tendency to split login forms into username/password over two screens as mentioned in this article. It's maddening. Password managers can't deal with this, unsurprisingly. I don't see the benefit this provides for anyone.

>Password managers can't deal with this, unsurprisingly Maybe I'm overly paranoid but I choose to manually copy my passwords out of my manager into the login form. Then again I also use a PW manager that doesn't support cloud storage. (Though you could always throw your DB into Dropbox if you desired)

[deleted]
Post reply on HN