This list reads like Brad trying to offering semi reasons why XX is bad, but then at the end of each point his real motive comes out which is he's just annoyed his password manager doesn't work smoothly.
Some points are valid, but the post just appears very biased.
Don’t Get Clever with Login Forms
211–220 of 520 posts
Re: Don’t Get Clever with Login Forms
#212I agree with a lot of this but magic links are great and I love them. Don't take away my magic login emails.
I'm surprised to see someone likes them, but after all there must be a reason if they exist. As someone who uses LastPass for pretty much every online form, I deeply hate magic login emails.
I'm fine with them existing, as long as you keep the classic email/password option. Something that usually takes me at most 5 seconds (wait for page to load and for LastPass to fill the fields, then click) ends up being a 30+seconds matter. How is this not terrible user experience???
Re: Don’t Get Clever with Login Forms
#213What does HN think of Google Invisible Recaptcha on login pages? We have it implemented but have been receiving feedback lately that it doesn't play nicely in many cases (no Google account, private browser windows, privacy plugins, etc). I'm trying to decide whether to remove it.
I suck a traffic lights so when my bosses wanted recaptchta instead of whatever-the-interesting-offers-spammers-send-through-our-contact-form I also added our office email address to all those contact forms. Personally I rather use the email address than fill in a form.
Re: Don’t Get Clever with Login Forms
#214What does HN think of Google Invisible Recaptcha on login pages? We have it implemented but have been receiving feedback lately that it doesn't play nicely in many cases (no Google account, private browser windows, privacy plugins, etc). I'm trying to decide whether to remove it.
I really dislike when it's blocked, but I have no idea.
Login forms should 100% have an error state shown to the user when the problem is the captcha not loading, being sent, etc.
I personally white-list the Recaptcha stuff just because there is a legit security benefit to it and not much else I'm aware of to work as well as it does.
Re: Don’t Get Clever with Login Forms
#215The worst offender I have seen in the wild is treasurydirect.gov. The password must be click in on an online keyboard, and they do not allow password managers to enter the passwords. Screenshot here: https://en.m.wikipedia.org/wiki/TreasuryDirect
> A virtual keyboard, with keys that display in random order, is available to deter others from learning your password. This is a weird way to describe keyloggers if that is actually what they are talking about. The random order I don't understand either unless the "keylogger" is also recording mouse positions. Otherwise, if this is actually talking about over shoulder lookers it probably has the exact opposite effec…
"The random order I don't understand either unless the "keylogger" is also recording mouse positions."
I would bet that that is exactly what they are worried about. This seems to me to be a really hacky way to solve that problem. If you actually need to address the possibility of keyloggers then some sort of 2FA setup would be simpler, more standard, would address a wider variety of potential security problems, and would create less friction for the user.
Re: Don’t Get Clever with Login Forms
#216There's been a recent tendency to split login forms into username/password over two screens as mentioned in this article. It's maddening. Password managers can't deal with this, unsurprisingly. I don't see the benefit this provides for anyone.
This was my first thought too
I saw it on Expensify yesterday
Doesn't this break a best practice? If you input an email address it tells you whethere there IS or ISN'T a user, and if there IS it asks you for their password.
I thought the best practice was to make it unclear whether an email or username is in the system, which would make this a huge regression
Re: Don’t Get Clever with Login Forms
#217One bit of cleverness I would like to see is allowing username and password to be entered together in the same field. Provide the normal, separate username and password fields, and if both are filled out proceed normally. If, however, the username is blank but the password is not, check to see if the value in the password field contains internal white space. If it does, split it on the first run of internal white spa…
Interesting idea. Communicating that functionality in the UI seems like a nightmare. Instructions would have to be available strictly through irc accessible only via tor.
Re: Don’t Get Clever with Login Forms
#218Earlier quoted context omitted.
>Password managers can't deal with this, unsurprisingly. I use a password manager too and often wonder about this. Does this responsibility fall on the website's designer/developer or the password manager? In one hand, I'd like my password manager to work on every site too but on the other, being a web developer/designer, I don't want another thing to support. We already have browsers and browser versions, and browse…
As a developer you should support a proper form that works with password managers. Period. Anything else is a failure on the developer's part to create a working login. It's also a massive security hole you've introduced by encouraging people not to use password managers. They will try to remember the password and we all know where that leads to. Sorry, if you think you can develop a login form that doesn't support p…
Why don't you respond to one of the comments that point out sensible reasons why a website might do this instead of using this as an opportunity to suggest that people are just incompetent?
Re: Don’t Get Clever with Login Forms
#219[deleted]
Re: Don’t Get Clever with Login Forms
#220The worst offender I have seen in the wild is treasurydirect.gov. The password must be click in on an online keyboard, and they do not allow password managers to enter the passwords. Screenshot here: https://en.m.wikipedia.org/wiki/TreasuryDirect
> A virtual keyboard, with keys that display in random order, is available to deter others from learning your password. This is a weird way to describe keyloggers if that is actually what they are talking about. The random order I don't understand either unless the "keylogger" is also recording mouse positions. Otherwise, if this is actually talking about over shoulder lookers it probably has the exact opposite effec…
It sounds like they learned password security from Runescape.