Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Don’t Get Clever with Login Forms

bradfrost.com

Post reply on HN
Print view View original

291–300 of 520 posts

Re: Don’t Get Clever with Login Forms

#291

Post by Sammi »

ben509 wrote: post #184
Sammi wrote: post #153

Earlier quoted context omitted.

All character related issues disappear when you hash the password. There is no problem here. Hashing the password should be the very first step taken on the backend when receiving login data, so any special characters should be neatly isolated to a part of the code that can handle UTF-8.

You have to get the data out of the text form. Unicode passwords mean all text entry forms on all browsers using all operating systems must be returning identical data, or at data that can be normalized to be bitwise identical without discarding the accents. While that may be doable, it would require aggressive testing to actually work... for a feature that's a. not necessary and b. of interest to a tiny minority of…

Ehhh no? I am at least not aware of any differences in utf-8 compatibility between browsers or other library implementations. UTF-8 is old and extremely standardized.

Re: Don’t Get Clever with Login Forms

#292

Post by geekrax »

The login form on TreasuryDirect is cancer.

- They split the form into two parts: Username/Account-Number and Password.

- The Username field disables autofill.

- The password field on the next page has a virtual keyboard. No autofill, the field is readonly.

I have been using this bookmarklet to "fix" these fields and let the password manager work on these fields:

javascript:document.querySelector("input[autocomplete='off']").removeAttribute('autocomplete');document.querySelector("input[readonly]").removeAttribute('readonly');

Re: Don’t Get Clever with Login Forms

#293

Post by lucb1e »

torstenvl wrote: post #267
deepspace wrote: post #262

Earlier quoted context omitted.

There is a South African bank (absa.co.za) that not only uses the online keyboard thing, but requires you to type in a randomized subset of your password. For example. if your password is "Password" it would display something like 2 5 7 and you are need to type "awr" (the 2nd, 5th and 7th letters of the password) to log in.

Unless they're storing hashes of every combination of characters in your password... seems pretty indicative of them storing the password in plain text.

Which is not that big a deal if you have a password manager with unique, randomly generated passwords. Exactly the scenario they're preventing...

And just in case it's not a joke, storing hashes of every subset is laughably easy to crack so that's plaintext-equivalent.

Re: Don’t Get Clever with Login Forms

#294

Post by rblatz »

geekrax wrote: post #292

The login form on TreasuryDirect is cancer. - They split the form into two parts: Username/Account-Number and Password. - The Username field disables autofill. - The password field on the next page has a virtual keyboard. No autofill, the field is readonly. I have been using this bookmarklet to "fix" these fields and let the password manager work on these fields: javascript:document.querySelector("input[autocomplete=…

I came here to specifically complain about TreasuryDirect. Thanks for the bookmark fix. I've just been going in to devtools and manually deleting the readonly. This will save me time and frustration.

Re: Don’t Get Clever with Login Forms

#295

Post by hnu0847 »

colinramsay wrote: post #2

There's been a recent tendency to split login forms into username/password over two screens as mentioned in this article. It's maddening. Password managers can't deal with this, unsurprisingly. I don't see the benefit this provides for anyone.

KeePass allows you to program a delay between entering the username and password, but I agree having two separate screens is annoying.

Re: Don’t Get Clever with Login Forms

#296

Post by CM30 »

cletus wrote: post #8

I would go further than this: don't get clever with logging in. Here's a list of "don't"s: - DON'T arbitrarily restrict my password from being too long - DON'T arbitrarily restrict me from using special characters - DON'T arbitrarily me require to use certain classes of characters (eg 1 uppercase, 1 lowercase and 1 number as a requirement; see https://xkcd.com/936/ ) - (this is a big one) DON'T TRY AND STOP ME PASTIN…

In other words, don't anything like this:

https://old.reddit.com/r/CrappyDesign/comments/aqwplw/more_o...

> must be at least 8 characters, but no longer than 30 characters, with at least 1 number, but no more than 15 numbers, with the first characters not being a number or symbol and various special characters being forbidden.

Re: Don’t Get Clever with Login Forms

#297

Post by lucb1e »

enobrev wrote: post #201
tzs wrote: post #189

One bit of cleverness I would like to see is allowing username and password to be entered together in the same field. Provide the normal, separate username and password fields, and if both are filled out proceed normally. If, however, the username is blank but the password is not, check to see if the value in the password field contains internal white space. If it does, split it on the first run of internal white spa…

Unless you have spaces in your password

Then just split on the first space (I do that a lot with text files that I parse, like `for line in file: date, hours_worked, comment = line.strip().split(' ', 2)`.

The real issue starts when you have spaces in your username. We should just use some non-printable, like, I don't know... tab?

Re: Don’t Get Clever with Login Forms

#298

Post by rcfox »

My company is planning to roll out a new login form with a "don't remember me" checkbox. The guy who implemented is standing by it because that's what the mockup showed, and the designer essentially covers his ears and shouts LA LA LA LA when you try to address it with him.

So yeah, I expect some fun comments when that eventually rolls out.

Re: Don’t Get Clever with Login Forms

#299

Post by mercurywells »

joshuaheard wrote: post #272

Another rule: make all fields pastable. If you have a form I can't fill in with my password manager, I can copy and paste my username and password with my password manager. Unless... you make those fields so I can't paste into them. Then, I have to open two windows side by side and manually type in my 16 digit password with caps, numbers, and symbols. Tedious.

One good justification for this is so it doesn't hinder accessibility for users that have difficulty typing.

Re: Don’t Get Clever with Login Forms

#300

Post by CM30 »

Here's another one:

Don't do what some banks do when they separate the password field into multiple boxes for various characters in your password. It's enough of a hassle trying to remember the password sometimes, let alone when you've got to randomly work out what the 3rd, 7th, 10th and 15th characters of it are too.

They also do this for the pin number too, which is obviously much easier to figure out but again adds unneeded stress for little extra security.

Post reply on HN