I just want to call out Mullvad VPN (in a good way) for only having one field, a super long account number, that acts as both username and password. Extra simple and extra private!
Don’t Get Clever with Login Forms
281–290 of 520 posts
Re: Don’t Get Clever with Login Forms
#282I stopped using Notion because of the email login thing. It got too annoying every time and slowly eroded my love of the product.
Re: Don’t Get Clever with Login Forms
#283Earlier quoted context omitted.
He gets to have the added insecurity if putting it on his clipboard for other programs to see on the way by. /s I actually can't imagine how it could be safer than having the password manager do it directly.
> He gets to have the added insecurity if putting it on his clipboard for other programs to see on the way by. If the local system is trustworthy, then none of the other programs are sniffing the clipboard looking to harvest passwords. And therefore there is no issue here. If the local system is untrustworthy and contains malware sniffing the clipboard looking to harvest passwords, then using or not using a password…
A password can end up on the clipboard and get picked up by some utility, stored in a history, log or swap file or otherwise get misplaced - this doesn't require a compromised system full of malicious software, just bugs and/or unexpected or unintended behaviour or interactions, which are fairly common.
Re: Don’t Get Clever with Login Forms
#284There's been a recent tendency to split login forms into username/password over two screens as mentioned in this article. It's maddening. Password managers can't deal with this, unsurprisingly. I don't see the benefit this provides for anyone.
Chromes built in password manager handles this fine.
Re: Don’t Get Clever with Login Forms
#285There's been a recent tendency to split login forms into username/password over two screens as mentioned in this article. It's maddening. Password managers can't deal with this, unsurprisingly. I don't see the benefit this provides for anyone.
The built in iOS password manager handles it.
Re: Don’t Get Clever with Login Forms
#286There's been a recent tendency to split login forms into username/password over two screens as mentioned in this article. It's maddening. Password managers can't deal with this, unsurprisingly. I don't see the benefit this provides for anyone.
If your platform supports 2FA, differing authentication mechanisms, or really anything that can make one accounts login process different to another, splitting it into 2 steps allows you to request the user ID first, then show the appropriate auth form for the second step. I agree you can achieve this by other means, but services may have their own reasons for doing it this way.
I’m thinking about how sites like the Amazon card payment site works. You enter your username and password, it sends you an MFA text that iOS automatically recognizes and offers to populate in the field.
Re: Don’t Get Clever with Login Forms
#287Another rule: make all fields pastable. If you have a form I can't fill in with my password manager, I can copy and paste my username and password with my password manager. Unless... you make those fields so I can't paste into them. Then, I have to open two windows side by side and manually type in my 16 digit password with caps, numbers, and symbols. Tedious.
It's easier to just hack the HTML IME. If pasting is blocked in JS, and the site has a (probably ancient) version of jQuery installed, just throw this in the console: $('*').unbind('paste');
We're talking about the general public! Can you imagine the phone conversation I would have with my dad about this? It would end in WW3.
Re: Don’t Get Clever with Login Forms
#288There's been a recent tendency to split login forms into username/password over two screens as mentioned in this article. It's maddening. Password managers can't deal with this, unsurprisingly. I don't see the benefit this provides for anyone.
The Firefox’s built in password manager deals with it just fine. No idea how, and no idea why others can’t cope if it can.
Re: Don’t Get Clever with Login Forms
#289> But it’s not just about creating consistency within your own ecosystem, it’s about being consistent with the rest of the internet.
FINALLY someone understands how important this is!!! Great article!
Re: Don’t Get Clever with Login Forms
#290Every time I logon to the AWS console I curse because the login is split across two pages and I have to select the correct login to autofill from my pwd manager twice.