Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Don’t Get Clever with Login Forms

bradfrost.com

Post reply on HN
Print view View original

161–170 of 520 posts

Re: Don’t Get Clever with Login Forms

#161

Post by nerdponx »

crazygringo wrote: post #140

> don’t put logins in modals LastPass fills out my username and password on modals just fine. Tested it out on Hertz just now. If other password managers don't... then they should be improved, no? Why should a site bother with a slower page load when an instant modal works just fine, as long as it's properly implemented? > don’t split login across multiple pages I've never seen this done except when it's necessary be…

Some modals do indeed seem to not-work with password managers. Twitch, Ebay, and Taobao are notable examples in my case.

Re: Don’t Get Clever with Login Forms

#162

Post by scarejunba »

bwood wrote: post #158
crazygringo wrote: post #140

> don’t put logins in modals LastPass fills out my username and password on modals just fine. Tested it out on Hertz just now. If other password managers don't... then they should be improved, no? Why should a site bother with a slower page load when an instant modal works just fine, as long as it's properly implemented? > don’t split login across multiple pages I've never seen this done except when it's necessary be…

>> don’t split login across multiple pages >I've never seen this done except when it's necessary because depending on the account identifier (username) a different authentication method is used -- e.g. redirecting to your institution's authentication page. I've actually noticed this becoming more common and I find it super annoying when there's no obvious need for it. Even Google does this now: https://i.imgur.com/ZH…

That allows federated login. You can federate Google login to Okta etc.

Re: Don’t Get Clever with Login Forms

#163

Post by montagg »

> don’t split login across multiple pages

At a company I work with, we found that splitting account creation and login fields across several pages actually simplified the account process for customers and led to increase sign ups and more reliable log-ins. It’s not as efficient for password managers—I use 1Password, too, and it’s a minor friction point for me personally—but for users, we have some evidence it actually increases clarity through focus.

Re: Don’t Get Clever with Login Forms

#164

Post by scarejunba »

reaperducer wrote: post #87
coryodaniel wrote: post #31

Earlier quoted context omitted.

That’s important. I find it funny[1] when you get the “email does not exist” error on a password reset page. [1] by “funny” I mean not funny

I wonder if that's a way for spammers to harvest known good e-mail addresses.

Those are available for free on the internet dude. This is a non-concern. The bad guys don't listen to GDPR. There are entire email lists available.

Re: Don’t Get Clever with Login Forms

#165

Post by mises »

Ayesh wrote: post #160
AnIdiotOnTheNet wrote: post #72

Earlier quoted context omitted.

I don't think that's true, it's just never been implemented in a way that wasn't bad. You could, for instance, let people have a public key to identify themselves. Your browser or other client could automatically submit your chosen key for you (or expose a button for you to submit it), then there's a challenge and response, and you're logged in. Your account details are stored with the public key as the id.

My developer self loves this idea, knowing that my secret key doesn't even leave the computer. My traveler self hates the idea, because I can't read my emails from my friend's phone when my phone is broken during our 6 month trek.

My security self hates this idea, because a single point of failure is not a good design. How would the key be revoked if lost? Replaced? This seems to necessitate a CA-type infrastructure (like TLS certs). Not something I'm comfortable trusting any corporation or government with.

Re: Don’t Get Clever with Login Forms

#166

Post by Technetium_Hat »

scarejunba wrote: post #162
bwood wrote: post #158

Earlier quoted context omitted.

>> don’t split login across multiple pages >I've never seen this done except when it's necessary because depending on the account identifier (username) a different authentication method is used -- e.g. redirecting to your institution's authentication page. I've actually noticed this becoming more common and I find it super annoying when there's no obvious need for it. Even Google does this now: https://i.imgur.com/ZH…

That allows federated login. You can federate Google login to Okta etc.

Yes, my school used to do this.

Re: Don’t Get Clever with Login Forms

#167

Post by StavrosK »

jrwoodruff wrote: post #136
tomc1985 wrote: post #47

Earlier quoted context omitted.

Pretty sure that is why... you enter your username and it checks to see what authentication flow to use, if it's a password flow then you get a password screen. Pisses me off too

Bingo. This is why we went with a stepped process. Did you log in with Google, Twitter, Enterprise SSO, or Email? Do you even have an account, maybe you need to create one? It frustrated everyone. Since we've implemented the stepped process (and made other changes) complaints have all but disappeared, and the number of failed sign in attempts has been significantly reduced, successful logins has increased slightly, a…

Your comment confuses me, can you clarify?

> This is why we went with a stepped process. [..] It frustrated everyone.

But then:

> Since we've implemented the stepped process (and made other changes) complaints have all but disappeared

Re: Don’t Get Clever with Login Forms

#168

Post by WorldMaker »

treve wrote: post #102
jillesvangurp wrote: post #84

It's 2019 and we're still doing email based signups, by default. What's wrong with this industry? OpenId was a pretty neat idea twelve years ago. And given the amount of password databases getting compromised, quite many websites would have been better off federating identity with a competent provider. But no, world plus dog still outsources security to email providers like hotmail, gmail, or worse. Basically comprom…

I also don't understand why Mozilla killed these projects. The original persona (BrowserID) was a pretty solid idea, but I think it's pretty expected for these things to take years of advocacy to pick up. I wonder if it was changed and canned simply because they didn't hit their early metrics.

My (lay) reading of it was that it was indirectly killed by the FirefoxOS efforts. A lot of the enthusiastic BrowserID/Persona folks got roped into the login/auth parts of FirefoxOS. I think a lot of good enthusiasm/energy was burnt by FirefoxOS not doing well, and that burnout was accidentally/indirectly the death of BrowserID/Persona more than anything else.

Re: Don’t Get Clever with Login Forms

#169

Post by WorldMaker »

mehrdadn wrote: post #133
jillesvangurp wrote: post #84

It's 2019 and we're still doing email based signups, by default. What's wrong with this industry? OpenId was a pretty neat idea twelve years ago. And given the amount of password databases getting compromised, quite many websites would have been better off federating identity with a competent provider. But no, world plus dog still outsources security to email providers like hotmail, gmail, or worse. Basically comprom…

> OpenId was a pretty neat idea twelve years ago. OpenId was maybe neat except for its little fatal flaw of being a single point of failure outside your control. Your provider decides your account should be taken down and suddenly you use access to everything.

Except OpenID was built for bloggers and you could change your account provider at anytime through URL delegation.

OpenID's flaw was being built for the web where everyone had a "homepage" or "blog" just as nearly everything shifted to social media and corporate-controlled walled gardens.

Re: Don’t Get Clever with Login Forms

#170

Post by IggleSniggle »

c17r wrote: post #86
reaperducer wrote: post #75

Earlier quoted context omitted.

Citibank is bad, too. It uses some kind of JS trick to replace usernames and passwords with asterisks, and you end up with all kinds of invalid information stored in your password manager.

I currently use BitWarden (LastPass previously) and neither have had a problem logging into Citi's website though it's been quite some time since I tried to add a new entry from their site.

+1 for BitWarden. For anyone reading this unfamiliar, it's an open source password manager with all the usual features (including iOS Fingerprint enabled client etc, shared group passwords), but the server is also open-source, and you can host your vault on your own server. It's free for individuals/families, supported by Enterprise licensing (or you can roll your own).
Post reply on HN