Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Don’t Get Clever with Login Forms

bradfrost.com

Post reply on HN
Print view View original

491–500 of 520 posts

Re: Don’t Get Clever with Login Forms

#491

Post by ric2b »

013a wrote: post #324

> don’t split login across multiple pages This is often necessary for enterprise applications; what they're often doing is making an intermediate request once they have your email address to determine how you log in. Do you use a password? Do you use SSO? If you use SSO, is it SAML? Do you have multiple accounts? Here's my experience, as an engineer at an enterprise company. We tried to put everything on one page, an…

So why not have an automatic login button next to the password that, when clicked, checks your e-mail to use the correct one?

Re: Don’t Get Clever with Login Forms

#492

Post by code_duck »

dsego wrote: post #488
code_duck wrote: post #485

Earlier quoted context omitted.

A minorly relevant note is that GP said ‘sign into’ a hotel, while you said ‘sign in to’, which is a subtlety difference a native speaker would know.

Oh, I actually use Writefull to check phrases, this one came up in Google Books. ( https://writefullapp.com/ ) "after the raid, it is known that Brown wrote to Kagi that he would sign into a hotel as I. Smith and Sons. As he began recruiting supporters for an attack" These are the results I get for web: - sign in to a hotel appears 0 time in Google. - sign into a hotel appears 81 times in Google. - check into a hotel…

OK, that’s interesting. I wouldn’t really trust to google books since it is OCRed.

I can’t get Google results like those with numbers on mobile, as far as I know. What comes up for me is discussions about what is grammatically proper in this case. https://www.quora.com/Which-is-grammatically-correct-check-i... for instance. All I had to search for was the phrase “check into hotel“, and the results show this is a hot topic of grammatical discussion because that is what came up rather than information about hotels.

‘Check into’ sounds different than ‘sign into’ to me, probably because few say sign vs check for a hotel. I suppose grammatically they’re the same.

I would certainly flag it when editing. I also do not commonly see anyone use the contracted form for this. The reason is that the verb is the phrase “sign in”. The word ‘in’ is not a candidate to be modified by being combined because it is paired with ‘sign’. We would never modify a single-word English verb by adding a suffix like ‘to’, and the same rule applies for phrase verbs. Beyond that, I’m not a grammar expert, so I would imagine the above link could shed more light than I can.

Re: Don’t Get Clever with Login Forms

#493

Post by Sammi »

kccqzy wrote: post #377
Sammi wrote: post #291

Earlier quoted context omitted.

Ehhh no? I am at least not aware of any differences in utf-8 compatibility between browsers or other library implementations. UTF-8 is old and extremely standardized.

Differences in for example, NFC or NFD forms of text, which is relatively common. And even for UTF-8, certain platforms don't properly encode code points beyond the BMP; they do it by encoding to UTF-16 surrogates and encoding the surrogates separately.

Web browsers don't normalize to NFC, NFD, or any other form, and you can control the normalization if you're making a mobile or desktop application. You as the login feature developer get to control and define in your backend interface what form you expect and handle.

In the backend you can choose to hash the non normalized string or a normalized one to the form you want. So this is all tightly under your control. There is no problem here.

More info: https://nukep.github.io/progblog/2015/02/26/some-gotchas-abo...

Re: Don’t Get Clever with Login Forms

#494

Post by dsego »

code_duck wrote: post #492
dsego wrote: post #488

Earlier quoted context omitted.

Oh, I actually use Writefull to check phrases, this one came up in Google Books. ( https://writefullapp.com/ ) "after the raid, it is known that Brown wrote to Kagi that he would sign into a hotel as I. Smith and Sons. As he began recruiting supporters for an attack" These are the results I get for web: - sign in to a hotel appears 0 time in Google. - sign into a hotel appears 81 times in Google. - check into a hotel…

OK, that’s interesting. I wouldn’t really trust to google books since it is OCRed. I can’t get Google results like those with numbers on mobile, as far as I know. What comes up for me is discussions about what is grammatically proper in this case. https://www.quora.com/Which-is-grammatically-correct-check-i... for instance. All I had to search for was the phrase “check into hotel“, and the results show this is a hot…

Thanks for the clarification, it makes sense.

Re: Don’t Get Clever with Login Forms

#495

Post by repolfx »

usr1106 wrote: post #440
MrStonedOne wrote: post #320

Earlier quoted context omitted.

The way google does auth is also two screened, email -> next -> password But! the "screen" is fake. the password field exists and is visible to the password manager (but not the end user) right off the bat, so it doesn't disrupt them.

Yeah, google might do it technically smart. But the user experience is extra poor, because they do not honor the Accept-Language header, but insist to use the local language of your public IP address. When travelling that can often be a language you don't understand. And when travelling you often get an extra security step, because they haven't seen you in that country before. Extra painful in a language you don't un…

It's extremely common that Accept-Language headers are wrong because people don't know how to configure their OS or browser with the right language preferences, e.g. they add their language preference second or not at all.

Re: Don’t Get Clever with Login Forms

#496

Post by michaelcampbell »

joshuaheard wrote: post #272

Another rule: make all fields pastable. If you have a form I can't fill in with my password manager, I can copy and paste my username and password with my password manager. Unless... you make those fields so I can't paste into them. Then, I have to open two windows side by side and manually type in my 16 digit password with caps, numbers, and symbols. Tedious.

Amen to that. There are chrome extensions (and Tampermonkey, etc.) things that will return paste-ability to sites that turn it off.

Re: Don’t Get Clever with Login Forms

#497

Post by eslaught »

code_duck wrote: post #492
dsego wrote: post #488

Earlier quoted context omitted.

Oh, I actually use Writefull to check phrases, this one came up in Google Books. ( https://writefullapp.com/ ) "after the raid, it is known that Brown wrote to Kagi that he would sign into a hotel as I. Smith and Sons. As he began recruiting supporters for an attack" These are the results I get for web: - sign in to a hotel appears 0 time in Google. - sign into a hotel appears 81 times in Google. - check into a hotel…

OK, that’s interesting. I wouldn’t really trust to google books since it is OCRed. I can’t get Google results like those with numbers on mobile, as far as I know. What comes up for me is discussions about what is grammatically proper in this case. https://www.quora.com/Which-is-grammatically-correct-check-i... for instance. All I had to search for was the phrase “check into hotel“, and the results show this is a hot…

Right, "check into the hotel" makes me think you're going to examine it, like you're suspicious of it's going to be a good one or something. Similar to how you might say "I'll check into that" if someone tells you to investigate something.

Re: Don’t Get Clever with Login Forms

#498

Post by mercer »

Spoom wrote: post #275
labster wrote: post #274

Earlier quoted context omitted.

It's easier to just hack the HTML IME. If pasting is blocked in JS, and the site has a (probably ancient) version of jQuery installed, just throw this in the console: $('*').unbind('paste');

There are also Chrome extensions that will attempt to remove any such restrictions automatically, like https://chrome.google.com/webstore/detail/dont-fuck-with-pas...

This extension can read and change all data on any website I visit. While I understand that this is necessary for it to work, am I alone in being very uncomfortable installing it for something so trivial (or, perhaps, at all)?

Re: Don’t Get Clever with Login Forms

#499

Post by tialaramex »

geofft wrote: post #475
dumpsterdiver wrote: post #382

Earlier quoted context omitted.

Regarding auto-fill, I second this. Password managers are great, but I would go so far as to advise against using password manager browser extensions entirely. You're adding several more vectors to be compromised, and imo the risk is not worth it. Navigate to the site, open the password manager, copy and paste the username and password into their respective fields. Yes, it's less convenient, but as we know convenienc…

> Navigate to the site, open the password manager, copy and paste the username and password into their respective fields. This leaves you vulnerable to (at least) two attacks: 1) Phishing. The password manager extension will refuse to send the password to the wrong site; it can't be fooled when tired the same way you can be fooled when tired. 2) The password stays around in your clipboard. There's a general risk of a…

Yeah, Security Keys definitely illustrate that "more convenient" isn't "less secure". Signing in with a Security Key is so painless, it's just a shame I can't do it in more places.

Use the clipboard as interprocess communications for secrets does seem dangerous. The 'pass' password manager I use has an option to do that if you want that, but I've rarely used it. However it may be less dangerous than you realise - by default pass will destroy clipboard items it added after 45 seconds. This is easy on X and, as far as I know, any modern graphical desktop, because the "clipboard" isn't (usually) really a static buffer, it's a live negotiated relationship between desktop clients, so "pasting" is an operation in which the copying software is itself actively involved, so if it were to crash, the content is gone, not left on the clipboard.

Re: Don’t Get Clever with Login Forms

#500

Post by rubenswieringa »

Point well made for 99% of the cases. Years back though, I worked on a web application for the elderly – try not getting clever with login forms to a userbase that doesn’t know the difference between logging in and signing up. There are definitely situations where it’s merited to (try to) overcome a lack of tech-savviness with unconventional UIs.
Post reply on HN