Progressive disclosure works with password managers as long as the hidden fields are still in the DOM and are simply rendered invisible to the user. For example, Apple's login forms work this way where they don't show the password until you've entered your Apple ID, but it still works just fine with 1Password (and with Safari's built-in password manager).
Don’t Get Clever with Login Forms
301–310 of 520 posts
Re: Don’t Get Clever with Login Forms
#302My company is planning to roll out a new login form with a "don't remember me" checkbox. The guy who implemented is standing by it because that's what the mockup showed, and the designer essentially covers his ears and shouts LA LA LA LA when you try to address it with him. So yeah, I expect some fun comments when that eventually rolls out.
Maybe you should (delete your comment and then) send them this thread
Re: Don’t Get Clever with Login Forms
#303The login form on TreasuryDirect is cancer. - They split the form into two parts: Username/Account-Number and Password. - The Username field disables autofill. - The password field on the next page has a virtual keyboard. No autofill, the field is readonly. I have been using this bookmarklet to "fix" these fields and let the password manager work on these fields: javascript:document.querySelector("input[autocomplete=…
Nice! I also wrote a script, but yours is much safer.
``` var s = 'PASSWORD'; for ( var i = 0; i < s.length; i++ ) { PasswordVK(s.charAt(i)); } ```
Re: Don’t Get Clever with Login Forms
#304Now do one of these for Captive Portal WiFi please!!
Re: Don’t Get Clever with Login Forms
#305Earlier quoted context omitted.
It's easier to just hack the HTML IME. If pasting is blocked in JS, and the site has a (probably ancient) version of jQuery installed, just throw this in the console: $('*').unbind('paste');
There are also Chrome extensions that will attempt to remove any such restrictions automatically, like https://chrome.google.com/webstore/detail/dont-fuck-with-pas...
Looks like it's also available for Firefox https://addons.mozilla.org/en-US/firefox/addon/don-t-fuck-wi...
Re: Don’t Get Clever with Login Forms
#306Progressive disclosure can be made to work with password managers, notably Apple's Apple ID login page[0] does this while still allowing the password manager to fill both username and passwords in one action. 0: https://appleid.apple.com/
As does https://accounts.google.com
Re: Don’t Get Clever with Login Forms
#307Earlier quoted context omitted.
My biggest (related) one is… In the sign-up process, validate the email (don't trust the user). I get a lot of emails that companies never validated, including for a while, from Wells Fargo.
Unfortunately, the trend is in the opposite direction. People have realized that email validation is a step in the funnel where you lose users. And when you look at it as a funnel conversion optimization problem, you arrive at myopic conclusions that are insecure and have externalities like the one you noticed.
[deleted]
Re: Don’t Get Clever with Login Forms
#308The reason the Delta interface hides the last name field is it's only necessary when entering a username. If you enter a Skymiles account # and password, you're not prompted for a last name (or at least I'm not).
Re: Don’t Get Clever with Login Forms
#309Earlier quoted context omitted.
My biggest one is... Requiring users to login with a username or customer id. (instead of email).
My biggest (related) one is… In the sign-up process, validate the email (don't trust the user). I get a lot of emails that companies never validated, including for a while, from Wells Fargo.
This bugs me as well. American Express kept sending me information about someone else's credit card. It took arguing with their customer service for about 20 minutes to get them to remove my email address from the account.
Re: Don’t Get Clever with Login Forms
#310My company is planning to roll out a new login form with a "don't remember me" checkbox. The guy who implemented is standing by it because that's what the mockup showed, and the designer essentially covers his ears and shouts LA LA LA LA when you try to address it with him. So yeah, I expect some fun comments when that eventually rolls out.
This default is only going to create security risks as users login on public-facing devices, like a library or device they don't own.
I hope you don't make PII or transactions available inside your app, otherwise I would urge escalating this issue internally.