Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Don’t Get Clever with Login Forms

bradfrost.com

Post reply on HN
Print view View original

331–340 of 520 posts

Re: Don’t Get Clever with Login Forms

#331

Post by argd678 »

joshuaheard wrote: post #272

Another rule: make all fields pastable. If you have a form I can't fill in with my password manager, I can copy and paste my username and password with my password manager. Unless... you make those fields so I can't paste into them. Then, I have to open two windows side by side and manually type in my 16 digit password with caps, numbers, and symbols. Tedious.

They do this to thwart hackers, for example to prevent a script that inputs the same password across many accounts. It’s terrible UX for sure.

Re: Don’t Get Clever with Login Forms

#332

Post by gourmetghetto »

labster wrote: post #274
joshuaheard wrote: post #272

Another rule: make all fields pastable. If you have a form I can't fill in with my password manager, I can copy and paste my username and password with my password manager. Unless... you make those fields so I can't paste into them. Then, I have to open two windows side by side and manually type in my 16 digit password with caps, numbers, and symbols. Tedious.

It's easier to just hack the HTML IME. If pasting is blocked in JS, and the site has a (probably ancient) version of jQuery installed, just throw this in the console: $('*').unbind('paste');

This is awesome and I can't believe it's the first it's ever crossed my mind. Good stuff.

Re: Don’t Get Clever with Login Forms

#333

Post by oefrha »

Spoom wrote: post #275
labster wrote: post #274

Earlier quoted context omitted.

It's easier to just hack the HTML IME. If pasting is blocked in JS, and the site has a (probably ancient) version of jQuery installed, just throw this in the console: $('*').unbind('paste');

There are also Chrome extensions that will attempt to remove any such restrictions automatically, like https://chrome.google.com/webstore/detail/dont-fuck-with-pas...

Lovely. I wish this were possible for some stupid mobile apps too, which tend to be extremely painful (triply so for ones that clear the password field as soon as I switch to 1Password to read the next five characters).

Re: Don’t Get Clever with Login Forms

#334

Post by gibybo »

argd678 wrote: post #331
joshuaheard wrote: post #272

Another rule: make all fields pastable. If you have a form I can't fill in with my password manager, I can copy and paste my username and password with my password manager. Unless... you make those fields so I can't paste into them. Then, I have to open two windows side by side and manually type in my 16 digit password with caps, numbers, and symbols. Tedious.

They do this to thwart hackers, for example to prevent a script that inputs the same password across many accounts. It’s terrible UX for sure.

We're going to be in trouble when hackers learn how to get around javascript that disables copy/paste.

Re: Don’t Get Clever with Login Forms

#335

Post by zachberger »

labster wrote: post #274
joshuaheard wrote: post #272

Another rule: make all fields pastable. If you have a form I can't fill in with my password manager, I can copy and paste my username and password with my password manager. Unless... you make those fields so I can't paste into them. Then, I have to open two windows side by side and manually type in my 16 digit password with caps, numbers, and symbols. Tedious.

It's easier to just hack the HTML IME. If pasting is blocked in JS, and the site has a (probably ancient) version of jQuery installed, just throw this in the console: $('*').unbind('paste');

This is great, but not easy to get into a console on mobile. I always struggle with United Airline's wifi which prevents paste, and I always try to access from mobile.

Re: Don’t Get Clever with Login Forms

#336

Post by Merad »

labster wrote: post #274
joshuaheard wrote: post #272

Another rule: make all fields pastable. If you have a form I can't fill in with my password manager, I can copy and paste my username and password with my password manager. Unless... you make those fields so I can't paste into them. Then, I have to open two windows side by side and manually type in my 16 digit password with caps, numbers, and symbols. Tedious.

It's easier to just hack the HTML IME. If pasting is blocked in JS, and the site has a (probably ancient) version of jQuery installed, just throw this in the console: $('*').unbind('paste');

In Firefox you can disable this stuff by setting dom.event.clipboardevents.enabled to false.

Re: Don’t Get Clever with Login Forms

#337

Post by nojvek »

argd678 wrote: post #328
013a wrote: post #324

> don’t split login across multiple pages This is often necessary for enterprise applications; what they're often doing is making an intermediate request once they have your email address to determine how you log in. Do you use a password? Do you use SSO? If you use SSO, is it SAML? Do you have multiple accounts? Here's my experience, as an engineer at an enterprise company. We tried to put everything on one page, an…

There needs to be a standard or something here to facilitate password mangers. Everyone should be using one and not reusing the same password.

I hate password managers with passion. In general passwords are hard to remember. Especially when every site has their own requirements. Password managers add too much friction.

I very much like login in with google. Even two factor TOTP is nice. I don’t have to remember things. I just need to carry a device with me.

Re: Don’t Get Clever with Login Forms

#338

Post by nojvek »

joshuaheard wrote: post #272

Another rule: make all fields pastable. If you have a form I can't fill in with my password manager, I can copy and paste my username and password with my password manager. Unless... you make those fields so I can't paste into them. Then, I have to open two windows side by side and manually type in my 16 digit password with caps, numbers, and symbols. Tedious.

Ha. Right click -> inspect element. In dev tools console. $0.value =“password”.

I use that in reverse when I can’t remember a password. Get the value from input element gives the browser remembered passwords.

Works on other peoples machines too. If you wanna steal remembered passwords.

That’s how chrome extensions steal passwords. Just sayin.

Re: Don’t Get Clever with Login Forms

#339

Post by beaconstudios »

nojvek wrote: post #337
argd678 wrote: post #328

Earlier quoted context omitted.

There needs to be a standard or something here to facilitate password mangers. Everyone should be using one and not reusing the same password.

I hate password managers with passion. In general passwords are hard to remember. Especially when every site has their own requirements. Password managers add too much friction. I very much like login in with google. Even two factor TOTP is nice. I don’t have to remember things. I just need to carry a device with me.

half the point of a password manager is to generate passwords so you don't have to think of (or repeat) them and the other half is to store them so you don't have to remember them. I'm not sure where the friction is coming from? In my experience they're easier than remembering a user/password combo by a long shot.

Re: Don’t Get Clever with Login Forms

#340

Post by dddddaviddddd »

ben_jones wrote: post #228
humblebee wrote: post #198

Earlier quoted context omitted.

> A virtual keyboard, with keys that display in random order, is available to deter others from learning your password. This is a weird way to describe keyloggers if that is actually what they are talking about. The random order I don't understand either unless the "keylogger" is also recording mouse positions. Otherwise, if this is actually talking about over shoulder lookers it probably has the exact opposite effec…

The irony is that if someone managed to install a keylogger, they could've installed any other RATing tool such that the machine itself and everything it touches it completely compromised.

Might not necessarily apply to a hardware keylogger, which an attacker might use to reduce the risk of detection in software.
Post reply on HN