381–390 of 520 posts
Earlier quoted context omitted.
Ha. Right click -> inspect element. In dev tools console. $0.value =“password”. I use that in reverse when I can’t remember a password. Get the value from input element gives the browser remembered passwords. Works on other peoples machines too. If you wanna steal remembered passwords. That’s how chrome extensions steal passwords. Just sayin.
Someone debunk this so I can sleep at night.
Earlier quoted context omitted.
The trick is to install a password manager browser extension, not to use a password manager that operates as an isolated app / CLI tool / website / etc. Then you unlock it once at the beginning of your session (or whatever frequency you feel like) and it will fill in passwords for you when you click, without having to copy/paste them. It's about as easy as external login / login with Google. (inb4 "but password manag…
Having auto-fill may be rather dangerous even if your password manager extension has no bugs whatsoever. I would not recommend this configuration. Having one touch form fill for credentials is good enough. It adds one touch to every intended login, but deletes the risk of credentials being captured when you weren't actually even trying to log in.
Navigate to the site, open the password manager, copy and paste the username and password into their respective fields. Yes, it's less convenient, but as we know convenience is the bane of security.
With authorization we have a few things available to us - something you know, something you have, something you are. To remain secure you will always use at least two of these when authorizing with a service.
The login information for my password manager is stored in my brain - something I know. The 2FA code I enter from my phone is gathered from not only something I have (my phone), but must be authenticated to with something I am (my face (although they could probably just brute force my pin)). I take it a step further by storing the 2FA codes for my most valued accounts on a completely separate device that I leave at home. /protip
> don’t split login across multiple pages This is often necessary for enterprise applications; what they're often doing is making an intermediate request once they have your email address to determine how you log in. Do you use a password? Do you use SSO? If you use SSO, is it SAML? Do you have multiple accounts? Here's my experience, as an engineer at an enterprise company. We tried to put everything on one page, an…
Another rule: make all fields pastable. If you have a form I can't fill in with my password manager, I can copy and paste my username and password with my password manager. Unless... you make those fields so I can't paste into them. Then, I have to open two windows side by side and manually type in my 16 digit password with caps, numbers, and symbols. Tedious.
> don’t split login across multiple pages This is often necessary for enterprise applications; what they're often doing is making an intermediate request once they have your email address to determine how you log in. Do you use a password? Do you use SSO? If you use SSO, is it SAML? Do you have multiple accounts? Here's my experience, as an engineer at an enterprise company. We tried to put everything on one page, an…
> Its absolutely hilarious to me that all of these Suggestions are motivated by the use of password managers. The number of people using password managers is literally a rounding error. I'm not so sure you're right in the general case, modern password managers are aimed at fairly normal people, there may very well be millions of password manager users. Nevertheless, even if we're a "rounding error" we are often decis…
For example Office365 uses a single email input on the login form. For enterprise users clicking "next" triggers an SSO flow that skips any password prompt.
If Office365 adopted the suggestions from the article and added a password field Brad Frost would be able to log in to his personal account from a single button press - a small optimisation for him - but many more users would be confused about the presence of a password input and potentially even be stopped from using the product at all.
Another rule: make all fields pastable. If you have a form I can't fill in with my password manager, I can copy and paste my username and password with my password manager. Unless... you make those fields so I can't paste into them. Then, I have to open two windows side by side and manually type in my 16 digit password with caps, numbers, and symbols. Tedious.
Pro tip: usually only the keyboard shortcut is disabled, but not the ‘paste’ item in the context menu. And overriding the context menu, in turn, can be disabled in the browser flags afaik (at least in FF). Or, the ‘Edit’ menu is there.
Earlier quoted context omitted.
Dropbox does an AJAX request when you enter your username, and it's fast enough that when you get to the password field it's already greyed out if you use SSO.
This should be the answer. As soon as the user enters a valid email (regex test) send a request to server to figure out what path they need to go down in the “federated flow”. What we shouldn’t do is diminish the experience for some because the flow for some others is different.
> don’t split login across multiple pages This is often necessary for enterprise applications; what they're often doing is making an intermediate request once they have your email address to determine how you log in. Do you use a password? Do you use SSO? If you use SSO, is it SAML? Do you have multiple accounts? Here's my experience, as an engineer at an enterprise company. We tried to put everything on one page, an…
There needs to be a standard or something here to facilitate password mangers. Everyone should be using one and not reusing the same password.
You'll then need an internet synced password manager with a web interface because you can't install programs on other people's laptops and it introduces a pre-step in the middle of the meeting any anyways you are trusting all passwords in the cloud. You could come up with more secure solutions like do client side decryption using symmetric keys but now you have a login step and a decryption step before you even use the password.
Basically this is why password managers don't really work for normal people - there is no good workflow when you need to use devices other than the ones you personally control.
Two factor authentication using fingerprint with mobile phone trends to be much better because generally people carry their mobile phones around and it's one touch.
I personally use my own algorithm that lets me create unique passwords with little mental effort for each use case.