Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Don’t Get Clever with Login Forms

bradfrost.com

Post reply on HN
Print view View original

261–270 of 520 posts

Re: Don’t Get Clever with Login Forms

#261

Post by __jal »

tylerl wrote: post #210
colinramsay wrote: post #2

There's been a recent tendency to split login forms into username/password over two screens as mentioned in this article. It's maddening. Password managers can't deal with this, unsurprisingly. I don't see the benefit this provides for anyone.

Actually this is necessary in order to support federated auth. Password managers have already figured out how to support this transparently, so it's a non-issue anymore... Including even Chrome's built in manager, which is not exactly cutting edge. If yours can't cope then it's a sign that your software isn't being actively maintained very well.

1Password has gotten confused a few times for me. (No way I'd ever use Chrome's. Or Apple's, for that matter.) Although now that I think about it, I think not in a while.

Still annoys me - a classic example of offloading the costs of technical decisions on the user, even if those costs are "just" mental energy and a page load. At the very least, if you feel you need to do this, make the login pages very, very lightweight. One I log in to daily has huge background images that are utterly, stupidly useless, wasteful, annoying and for some reason uncacheable.

Re: Don’t Get Clever with Login Forms

#262

Post by deepspace »

Apylon777 wrote: post #63

The worst offender I have seen in the wild is treasurydirect.gov. The password must be click in on an online keyboard, and they do not allow password managers to enter the passwords. Screenshot here: https://en.m.wikipedia.org/wiki/TreasuryDirect

There is a South African bank (absa.co.za) that not only uses the online keyboard thing, but requires you to type in a randomized subset of your password. For example. if your password is "Password" it would display something like 257 and you are need to type "awr" (the 2nd, 5th and 7th letters of the password) to log in.

Re: Don’t Get Clever with Login Forms

#263

Post by Cpoll »

ben_jones wrote: post #228
humblebee wrote: post #198

Earlier quoted context omitted.

> A virtual keyboard, with keys that display in random order, is available to deter others from learning your password. This is a weird way to describe keyloggers if that is actually what they are talking about. The random order I don't understand either unless the "keylogger" is also recording mouse positions. Otherwise, if this is actually talking about over shoulder lookers it probably has the exact opposite effec…

The irony is that if someone managed to install a keylogger, they could've installed any other RATing tool such that the machine itself and everything it touches it completely compromised.

I imagine 99% of keyloggers are the 'put this on as many machines as possible and look for worthwhile logins' type, which are well-thwarted by this approach.

Anything more bespoke than that is probably much rarer.

Re: Don’t Get Clever with Login Forms

#264

Post by huy-nguyen »

kiliankoe wrote: post #256
eeeeeeeeeeeee wrote: post #248

Earlier quoted context omitted.

I like the magic links, but more as a secondary option or at least an equal option to a password. I have yet to see a site completely depend on the magic links and I hope that doesn't become a thing. I also really like the "go to this website on your computer and enter this code" for logging in to Apple TV, Chromecast, etc so you aren't typing a 30 character password on a TV remote.

Notion uses magic links only for their login and it's aggravating. It may be nice for some users, but using my password manager's autofill is much faster than going to my inbox and clicking a link.

I think Medium does this too (unless you want to log in with your social account, which I don't like for privacy reason) and it really annoys me.

Re: Don’t Get Clever with Login Forms

#265

Post by schroffl »

astine wrote: post #223

Is there any technical reason that a password manager cannot be made to work with split logins or hidden fields? Shouldn't they have access to the same web browser that user does? I'd think that could be scripted to handle these things. Obviously this makes it more complex for password managers to auto-enter passwords, different websites will have different scripts but I see no reason for this to be an insurmountable…

I made a custom password manager a while back [1] where I used the MutationObserver API [2] to detect when a field is unhidden or newly added. I mainly did it to deal with iClouds login flow. The performance of that could probably be improved by figuring out the container of the login and only attaching the observer to that. But the whole thing was never really finished and I eventually forgot about it.

[1] https://github.com/schroffl/browser-password [2] https://developer.mozilla.org/en-US/docs/Web/API/MutationObs...

Re: Don’t Get Clever with Login Forms

#266

Post by 0xfeba »

pbreit wrote: post #236
colinramsay wrote: post #2

There's been a recent tendency to split login forms into username/password over two screens as mentioned in this article. It's maddening. Password managers can't deal with this, unsurprisingly. I don't see the benefit this provides for anyone.

I don't see why password managers can't deal with this. In fact don't most handle it OK?

Yeah I can set a delay or custom keypresses, or field IDs in KeyPass. This and OP just have to configure it properly.

Re: Don’t Get Clever with Login Forms

#267

Post by torstenvl »

deepspace wrote: post #262
Apylon777 wrote: post #63

The worst offender I have seen in the wild is treasurydirect.gov. The password must be click in on an online keyboard, and they do not allow password managers to enter the passwords. Screenshot here: https://en.m.wikipedia.org/wiki/TreasuryDirect

There is a South African bank (absa.co.za) that not only uses the online keyboard thing, but requires you to type in a randomized subset of your password. For example. if your password is "Password" it would display something like 2 5 7 and you are need to type "awr" (the 2nd, 5th and 7th letters of the password) to log in.

Unless they're storing hashes of every combination of characters in your password... seems pretty indicative of them storing the password in plain text.

Re: Don’t Get Clever with Login Forms

#268

Post by weej »

colinramsay wrote: post #2

There's been a recent tendency to split login forms into username/password over two screens as mentioned in this article. It's maddening. Password managers can't deal with this, unsurprisingly. I don't see the benefit this provides for anyone.

Really? I don't have that problem with LastPass. It simply inspects the domain in the URL and DOM element name for the given web page. If it's a password field in the form (even if on separate page that's stand alone) maps back to the domain the creds are stored in LastPass it will give me the option to inject the password into the form field.

Re: Don’t Get Clever with Login Forms

#269

Post by 0xfeba »

dontbenebby wrote: post #88
colinramsay wrote: post #2

There's been a recent tendency to split login forms into username/password over two screens as mentioned in this article. It's maddening. Password managers can't deal with this, unsurprisingly. I don't see the benefit this provides for anyone.

>Password managers can't deal with this, unsurprisingly Maybe I'm overly paranoid but I choose to manually copy my passwords out of my manager into the login form. Then again I also use a PW manager that doesn't support cloud storage. (Though you could always throw your DB into Dropbox if you desired)

KeyPass? That's what I use and I probably am 50/50 between using autofill or Copy+Paste. And it autoclears after a few seconds.

And I store my DB in Dropbox, but not the key.

Re: Don’t Get Clever with Login Forms

#270

Post by amdelamar »

nickjj wrote: post #246

Most of his issues with magic links don't exist everywhere. Maybe "Notion's" magic links are bad, but not everyone does that. They're not tedious if you persist the login beyond 1 session. There's also no need for any type of codes. You just receive the email, open it, click the link and then you could be potentially logged in for months or longer (it's up to the site who issues the link). It's one of the easiest and…

Magic link emails are terribly slooooow. Waiting for that email takes too long most of the time. I could've already logged in with a password by now, not even using a password manager.
Post reply on HN