Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Don’t Get Clever with Login Forms

bradfrost.com

Post reply on HN
Print view View original

141–150 of 520 posts

Re: Don’t Get Clever with Login Forms

#141

Post by FabHK »

ocdtrekkie wrote: post #114
wipash wrote: post #68

Earlier quoted context omitted.

But with a password manager, you don't need to make that distinction. If it's trivial to make all passwords unique, why not do it?

The issue is that password managers are a huge weak point and a significant compromise in your security. Generally password managers have some sort of master password, which unlocks access to all of your other accounts . Why bother setting different passwords for every account if one password unlocks them all anyhow? Password manager security flaws are also a dime a dozen, and none of them have been without significa…

Because that one password is pretty long and secure, and you enter it only on your own machine, into one known binary, no-where else.

It strikes me as sensible advice.

Connecting your password manager to the browser for auto-fill already compromises the security, granted, but what other flaws have there been otherwise?

Re: Don’t Get Clever with Login Forms

#142

Post by CM30 »

mikewhy wrote: post #123
sonnyblarney wrote: post #50

Modality is ok. The reason being, a 'login' is often an interruption to the normal flow of experience. Trying to do 'A' then 'B' - need to login for 'B'. This is why modals exist. The background to the modal gives the context to 'where the login is happening'. If there is no context then it can have it's own screen. The absolute worst is when you're doing a bunch of stuff, you login, and the app does not forward you…

Agreed. Modality isn't bad. The author's concerns about them can be boiled down to "make sure your login form has a URL".

Yeah. Works fine to have a modal based login form for those with JavaScript and a static page version as a non JS/general fallback, and that'd be the best of both worlds.

Re: Don’t Get Clever with Login Forms

#143

Post by jiveturkey »

colinramsay wrote: post #2

There's been a recent tendency to split login forms into username/password over two screens as mentioned in this article. It's maddening. Password managers can't deal with this, unsurprisingly. I don't see the benefit this provides for anyone.

1password deals with this just fine.

Re: Don’t Get Clever with Login Forms

#145

Post by Sammi »

cletus wrote: post #8

I would go further than this: don't get clever with logging in. Here's a list of "don't"s: - DON'T arbitrarily restrict my password from being too long - DON'T arbitrarily restrict me from using special characters - DON'T arbitrarily me require to use certain classes of characters (eg 1 uppercase, 1 lowercase and 1 number as a requirement; see https://xkcd.com/936/ ) - (this is a big one) DON'T TRY AND STOP ME PASTIN…

And if anyone raises a concern about accepting and transferring arbitrarily long passwords to the backend: Just take a quick digest hash of it on the client side (SHA512 or something) and send that UNcryptographic hash of the password to the backend to be properly cryptographically hashed there like regular. The digest hash becomes the password and the user is happy to not encounter any arbitrary restrictions on length.

This is how dropbox does it: https://blogs.dropbox.com/tech/2016/09/how-dropbox-securely-...

Re: Don’t Get Clever with Login Forms

#147

Post by blktiger »

colinramsay wrote: post #2

There's been a recent tendency to split login forms into username/password over two screens as mentioned in this article. It's maddening. Password managers can't deal with this, unsurprisingly. I don't see the benefit this provides for anyone.

Microsoft does this and the built-in password manager on Safari works with it just fine.

Re: Don’t Get Clever with Login Forms

#148

Post by edoo »

I was a regular user of Expedia until some genius got the idea to disallow pasting into the password prompt. That was a few years ago and I couldn't tell you to this day if they fixed it or not. It was probably a short lived experiment.

Re: Don’t Get Clever with Login Forms

#149

Post by jiveturkey »

dontbenebby wrote: post #88
colinramsay wrote: post #2

There's been a recent tendency to split login forms into username/password over two screens as mentioned in this article. It's maddening. Password managers can't deal with this, unsurprisingly. I don't see the benefit this provides for anyone.

>Password managers can't deal with this, unsurprisingly Maybe I'm overly paranoid but I choose to manually copy my passwords out of my manager into the login form. Then again I also use a PW manager that doesn't support cloud storage. (Though you could always throw your DB into Dropbox if you desired)

You're doing it wrong.

The password manager (implemented correctly) will only fill in the form on the legitimate site. This protects against phishing.

Re: Don’t Get Clever with Login Forms

#150

Post by jeffmk »

Apylon777 wrote: post #63

The worst offender I have seen in the wild is treasurydirect.gov. The password must be click in on an online keyboard, and they do not allow password managers to enter the passwords. Screenshot here: https://en.m.wikipedia.org/wiki/TreasuryDirect

The flow can be even more complicated:

  1. "Does your account number begin with a *letter*"
Opening up devtools and deleting the `readonly` attribute does allow you to paste from your password manager of choice without further hassle.
Post reply on HN