Don’t Get Clever with Login Forms • Hacker News Board

Re: Don’t Get Clever with Login Forms

#231

Post by gammateam » Fri, Feb 15, 2019, 7:51 PM UTC

hombre_fatal wrote: post #221

gammateam wrote: post #216

Earlier quoted context omitted.

This was my first thought too I saw it on Expensify yesterday Doesn't this break a best practice? If you input an email address it tells you whethere there IS or ISN'T a user, and if there IS it asks you for their password. I thought the best practice was to make it unclear whether an email or username is in the system, which would make this a huge regression

It doesn't change anything. If the email doesn't exist, you can always redirect to the password form. If the user is confused about their credentials, they'll have to use the "I forgot" system in both cases.

Expensify shows an avatar for the user

Re: Don’t Get Clever with Login Forms

#232

Post by ecnahc515 » Fri, Feb 15, 2019, 7:52 PM UTC

schwap wrote: post #183

StavrosK wrote: post #167

Earlier quoted context omitted.

Your comment confuses me, can you clarify? > This is why we went with a stepped process. [..] It frustrated everyone. But then: > Since we've implemented the stepped process (and made other changes) complaints have all but disappeared

Choose login method first = frustration (users may not remember what IdP they used) Stepped process = drop in complaints

OMG yes. We went with "choose the login option" and it sucked. Everyone created multiple accounts (we didn't support combined identity at the time) and it just..sucked.

Re: Don’t Get Clever with Login Forms

#233

Post by 0xCMP » Fri, Feb 15, 2019, 7:54 PM UTC

Magic links are a valid method of login that is "right" for many users who end up resetting their accounts anyways.

It's better than using true SSO in the sense that "email is decentralized." Yes, that means if their email is compromised the account is compromised, but how many accounts are there are aren't already compromised when using a random password if the email account is insecure? Every story I've heard of an attacker gaining "access to everything" involves attacking the Email account in some way to then password reset everything.

You may also complain that Email is literally not secure so the link could be intercepted unless it was PGP encrypted (somehow). I grant that I think this is perfectly legitimate when the user is facing more advanced attackers (possibly those with passive access to traffic or backend access to emails. NSA or Company IT come to mind) and hence maybe the need for U2F or TOTP.

We get so many "password reset" emails on our old system that I think it'd just be better if they could login with just an email.

Users should use strong and secure methods for their email(s) and websites so err on the side of Magic Links or SSO. Preferably Magic Links because they expose less about the user by default except their email.

Re: Don’t Get Clever with Login Forms

#234

Post by hombre_fatal » Fri, Feb 15, 2019, 7:55 PM UTC

philip1209 wrote: post #208

What does HN think of Google Invisible Recaptcha on login pages? We have it implemented but have been receiving feedback lately that it doesn't play nicely in many cases (no Google account, private browser windows, privacy plugins, etc). I'm trying to decide whether to remove it.

HN even uses it.

It's a decent trade-off. Also, most users will check "remember me" and won't see your login form regularly.

I haven't seen HN's login form since I registered two months ago.

Re: Don’t Get Clever with Login Forms

#235

Post by cronix » Fri, Feb 15, 2019, 7:55 PM UTC

TLDR: I use some password managers that don't work on websites unless you use the format the particular password manager I chose to use, is using. Therefore, web devs, please adjust your code so that my password manager of choice will work, and keep up with the ever growing list of password managers that have nothing to do with your website. It will make my life easier. Thank you!

Re: Don’t Get Clever with Login Forms

#236

Post by pbreit » Fri, Feb 15, 2019, 7:57 PM UTC

colinramsay wrote: post #2

There's been a recent tendency to split login forms into username/password over two screens as mentioned in this article. It's maddening. Password managers can't deal with this, unsurprisingly. I don't see the benefit this provides for anyone.

I don't see why password managers can't deal with this. In fact don't most handle it OK?

Re: Don’t Get Clever with Login Forms

#237

Post by echeese » Fri, Feb 15, 2019, 8:01 PM UTC

Also, set the autocomplete attribute: https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes...

Re: Don’t Get Clever with Login Forms

#238

Post by pkamb » Fri, Feb 15, 2019, 8:02 PM UTC

humblebee wrote: post #198

Apylon777 wrote: post #63

The worst offender I have seen in the wild is treasurydirect.gov. The password must be click in on an online keyboard, and they do not allow password managers to enter the passwords. Screenshot here: https://en.m.wikipedia.org/wiki/TreasuryDirect

> A virtual keyboard, with keys that display in random order, is available to deter others from learning your password. This is a weird way to describe keyloggers if that is actually what they are talking about. The random order I don't understand either unless the "keylogger" is also recording mouse positions. Otherwise, if this is actually talking about over shoulder lookers it probably has the exact opposite effec…

The "random keypad order" is used on secure physical keypads, which display a random order of numbers so that fingerprints, key wear, etc. can't be used to isolate the keys being pressed over time.

Re: Don’t Get Clever with Login Forms

#239

Post by erichurkman » Fri, Feb 15, 2019, 8:03 PM UTC

gammateam wrote: post #216

colinramsay wrote: post #2

There's been a recent tendency to split login forms into username/password over two screens as mentioned in this article. It's maddening. Password managers can't deal with this, unsurprisingly. I don't see the benefit this provides for anyone.

This was my first thought too I saw it on Expensify yesterday Doesn't this break a best practice? If you input an email address it tells you whethere there IS or ISN'T a user, and if there IS it asks you for their password. I thought the best practice was to make it unclear whether an email or username is in the system, which would make this a huge regression

> I thought the best practice was to make it unclear whether an email or username is in the system

It's useless obfuscation. 99% of systems that tell you "if you entered a valid username, we'll email you a password reset link" also don't allow duplicate accounts by email. Try to register a duplicate on their sign up page and they will tell you "this email address is already in use."

Useless "security" obfuscation and creates a terrible user experience trying to reset passwords.

Re: Don’t Get Clever with Login Forms

#240

Post by blhack » Fri, Feb 15, 2019, 8:04 PM UTC

Since these threads often become: patterns I think are stupid.

On the Xbox One (which runs the home theater in our house): it hides the characters of your password, which I think is somewhat silly to begin with, but you type it in with a giant, on screen keyboard!