Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Don’t Get Clever with Login Forms

bradfrost.com

Post reply on HN
Print view View original

241–250 of 520 posts

Re: Don’t Get Clever with Login Forms

#241

Post by ArrayList »

reaperducer wrote: post #75
Apylon777 wrote: post #63

The worst offender I have seen in the wild is treasurydirect.gov. The password must be click in on an online keyboard, and they do not allow password managers to enter the passwords. Screenshot here: https://en.m.wikipedia.org/wiki/TreasuryDirect

Citibank is bad, too. It uses some kind of JS trick to replace usernames and passwords with asterisks, and you end up with all kinds of invalid information stored in your password manager.

Citibank absolutely sucks for overall UX.

Have they ever heard of input type="password"?

Re: Don’t Get Clever with Login Forms

#242

Post by Operyl »

colinramsay wrote: post #2

There's been a recent tendency to split login forms into username/password over two screens as mentioned in this article. It's maddening. Password managers can't deal with this, unsurprisingly. I don't see the benefit this provides for anyone.

My password manager can deal with it:

Cmd + \, Enter, Cmd + \, Enter.

It is a little saddening, perhaps, but to say it’s breaking password managers entirely is a wrong.

Re: Don’t Get Clever with Login Forms

#243

Post by Karawebnetwork »

kgwxd wrote: post #108
Karawebnetwork wrote: post #66

Earlier quoted context omitted.

A lot of our users would complain that writing on our product support forum was hard. Since we added those option, the friction is gone. People who need help that can be boiled down to "Did you plug it in? Is the battery full? What about turning it off and on again" have a hard time understanding how to register an account. Thinking of a strong password and then figuring out how to click on the confirmation link in t…

Sounds like a scenario where that friction would actually be desirable. If they got far enough to file a complaint they can obviously handle it, they're just lazy complainers, which is exactly the type of user I'd rather didn't make it to the support page anyway. Like you said, their problem usually boils down to plug, charge or reset and they were just too lazy to search the knowledge base for basic troubleshooting,…

That's a good way to lose loyal customers who order many times a year.

Re: Don’t Get Clever with Login Forms

#245

Post by exochrono »

blhack wrote: post #240

Since these threads often become: patterns I think are stupid. On the Xbox One (which runs the home theater in our house): it hides the characters of your password, which I think is somewhat silly to begin with, but you type it in with a giant, on screen keyboard!

As someone else in the room who doesn't want to see your password, it's a lot easier to avoid seeing all the characters you're typing in than avoid accidentally seeing the password if it's in plaintext on the big screen.

Re: Don’t Get Clever with Login Forms

#246

Post by nickjj »

Most of his issues with magic links don't exist everywhere. Maybe "Notion's" magic links are bad, but not everyone does that.

They're not tedious if you persist the login beyond 1 session.

There's also no need for any type of codes. You just receive the email, open it, click the link and then you could be potentially logged in for months or longer (it's up to the site who issues the link).

It's one of the easiest and fastest flows you can ask for with technology that works today in all major browsers.

Re: Don’t Get Clever with Login Forms

#247

Post by Operyl »

johndough wrote: post #203
wccrawford wrote: post #119

Earlier quoted context omitted.

He gets to have the added insecurity if putting it on his clipboard for other programs to see on the way by. /s I actually can't imagine how it could be safer than having the password manager do it directly.

One possible way to exploit this is: - user copy-and-pastes password - user forgets to clear clipboard - user opens a link in a new tab with middle-click - link was actually a text form - middle-click pasted the password into the textfield (only on platforms with middle-click configured as paste) I noticed this when I had an image url in my clipboard and tried on open a link on imgur.com in a new tab. Instead of open…

A lot of password managers clear or restore the clipboard after a short period.

Re: Don’t Get Clever with Login Forms

#248

Post by eeeeeeeeeeeee »

0xCMP wrote: post #233

Magic links are a valid method of login that is "right" for many users who end up resetting their accounts anyways. It's better than using true SSO in the sense that "email is decentralized." Yes, that means if their email is compromised the account is compromised, but how many accounts are there are aren't already compromised when using a random password if the email account is insecure? Every story I've heard of an…

I like the magic links, but more as a secondary option or at least an equal option to a password. I have yet to see a site completely depend on the magic links and I hope that doesn't become a thing.

I also really like the "go to this website on your computer and enter this code" for logging in to Apple TV, Chromecast, etc so you aren't typing a 30 character password on a TV remote.

Re: Don’t Get Clever with Login Forms

#249

Post by eeeeeeeeeeeee »

crazygringo wrote: post #140

> don’t put logins in modals LastPass fills out my username and password on modals just fine. Tested it out on Hertz just now. If other password managers don't... then they should be improved, no? Why should a site bother with a slower page load when an instant modal works just fine, as long as it's properly implemented? > don’t split login across multiple pages I've never seen this done except when it's necessary be…

I think most password managers can handle modals, but it really depends on the site. I use 1Password and I'd say most of them work, but sometimes it doesn't.

The point remains -- the WordPress login page is simple and it just works. Why does everyone need to get so fancy with a login prompt?

Re: Don’t Get Clever with Login Forms

#250

Post by ArrayList »

ocdtrekkie wrote: post #114
wipash wrote: post #68

Earlier quoted context omitted.

But with a password manager, you don't need to make that distinction. If it's trivial to make all passwords unique, why not do it?

The issue is that password managers are a huge weak point and a significant compromise in your security. Generally password managers have some sort of master password, which unlocks access to all of your other accounts . Why bother setting different passwords for every account if one password unlocks them all anyhow? Password manager security flaws are also a dime a dozen, and none of them have been without significa…

I actually totally agree with you. It's insanity. I never made the "jump" to LastPass/BitWarden/etc. because it always left a bad taste in my mouth to have one password that would crack my entire online presence.
Post reply on HN