Don’t Get Clever with Login Forms

Post by saagarjha » Sat, Feb 16, 2019, 10:43 AM UTC

pmjordan wrote: post #253

saagarjha wrote: post #205

Earlier quoted context omitted.

This is not necessarily true. iOS, for example, does not allow for key logging but will happily allow Facebook to grab whatever you have on your clipboard, which it does of course because it's Facebook.

I think I've spotted iOS clearing the clipboard if you task-switch after pasting the contents into a password input field. Which is presumably precisely to defend against this kind of data theft.

Post by darkhorn » Sat, Feb 16, 2019, 11:41 AM UTC

deepspace wrote: post #262

Apylon777 wrote: post #63

The worst offender I have seen in the wild is treasurydirect.gov. The password must be click in on an online keyboard, and they do not allow password managers to enter the passwords. Screenshot here: https://en.m.wikipedia.org/wiki/TreasuryDirect

There is a South African bank (absa.co.za) that not only uses the online keyboard thing, but requires you to type in a randomized subset of your password. For example. if your password is "Password" it would display something like 2 5 7 and you are need to type "awr" (the 2nd, 5th and 7th letters of the password) to log in.

Post by chrisan » Sat, Feb 16, 2019, 12:01 PM UTC

amaccuish wrote: post #3

colinramsay wrote: post #2

There's been a recent tendency to split login forms into username/password over two screens as mentioned in this article. It's maddening. Password managers can't deal with this, unsurprisingly. I don't see the benefit this provides for anyone.

That is quite useful however with some federated auth flows, where you just need the email to see where to send them for the actual auth (e.g. Office365 and SAML login), otherwise you'd needlessly be entering your password. I also much prefer it to the previous way e.g. Office365 worked, where once you'd tabbed away from the email box, they'd detect you needed to be redirected and send you off, whilst most people had…

Post by muzani » Sat, Feb 16, 2019, 12:17 PM UTC

Al-Khwarizmi wrote: post #464

Tip from a non-native English speaker: if you want your website to be more friendly to an international audience, don't use the terms "sign in" and "sign up", use more distinct terms (like "login" and "register") instead. Phrasal verbs, in general, are difficult to speakers of languages that don't have them, especially when the same verb has different meanings depending on the added preposition. Someone with a basic/…

Post by DCoder » Sat, Feb 16, 2019, 12:32 PM UTC

danlugo92 wrote: post #408

Spoom wrote: post #275

Earlier quoted context omitted.

There are also Chrome extensions that will attempt to remove any such restrictions automatically, like https://chrome.google.com/webstore/detail/dont-fuck-with-pas...

Sadly doesn't work with one of my banks (it detects the ctrl key on keydown)