Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Substack's UI and 1Password temporarily cost me $2k

timmyomahony.com

Post reply on HN
Print view View original

101–110 of 278 posts

Re: Substack's UI and 1Password temporarily cost me $2k

#101

Post by enjoylife »

MattGaiser wrote: post #83
thanksforfish wrote: post #38

Earlier quoted context omitted.

Whats the solution for the busy engineer? Anyone know a Selenium plug in that let's you run with browser extensions or something? There's too many popular extensions to test manually.

This is probably so far down the list that I would be interested to hear of any kind of testing of extensions at all for non-extension companies.

Haven't seen this automated, but I have seen internal issues raised by folks within large orgs when their extension started breaking things. But it's only once you have 50+ to 100's of engineers working on a product, each with a subset of extensions installed, that you can rely on the cross product of engineers and their installed extensions for realistic coverage.

Re: Substack's UI and 1Password temporarily cost me $2k

#102

Post by hombre_fatal »

Cldfire wrote: post #98
hombre_fatal wrote: post #52

Earlier quoted context omitted.

Password managers aren't nearly intelligent enough to be used without copy and paste for sensitive forms. One example is how almost every password manager including the built-in one in most browsers will assume that if there's a type="password" field, then the previous sibling field must be the username. Sometimes they'll even pick a field far away in the DOM like your chatbox input to autofill with the username. So…

> One example is how almost every password manager including the built-in one in most browsers will assume that if there's a type="password" field, then the previous sibling field must be the username. Sometimes they'll even pick a field far away in the DOM like your chatbox input to autofill with the username. Note that this behavior is defined as part of the `autocomplete` standard. https://html.spec.whatwg.org/mul…

Nice note. One problem is that you are left without options, only hacks, to work around this heavy handed behavior. It wouldn't be so bad if you could opt-out with autocomplete="off".

And even if it did work, a spec is always underspecified even for the password manager who wants to follow it 1:1, so even in a best case scenario, you don't have implementation consensus. For example, you would think password manager heuristics wouldn't look outside the current to assume the username field, but some do on some browsers.

The end result is that if you have a need that isn't the general case, you end up having to trade away UX to cater to software.

Re: Substack's UI and 1Password temporarily cost me $2k

#103

Post by paulryanrogers »

bfdm wrote: post #99
askmike wrote: post #34

Earlier quoted context omitted.

To counter this: if you happen to find yourself on the phishing domain facebo0k.com and you end up copying your password into that.. Browser extensions guard for this better than we can.

Maybe we should take the best of both worlds then: an extension that only knows which domains you have passwords saved for, but not the account or PW. It just serves as a red flag if the domain is suspect.

This is how the Keepass Helper extension has worked for years: putting the domain in the RHS of the titlebar. Then with autotype set to match that you can autotype from the global hotkey. Keepass 2 can even split the credentials between key presses and pasting.

There are other URL in title extensions for most browsers. And they're simple enough you can audit them or write your own.

Re: Substack's UI and 1Password temporarily cost me $2k

#104

Post by lamontcg »

chrismorgan wrote: post #77
onelovetwo wrote: post #65

Earlier quoted context omitted.

Or 1Pass does a little bit more smart in checking before randomly entering text? It wouldn't be difficult to catch this

The problem is that all of these autofillers are already way too complex, because almost no one uses the optimal markup (adding the attribute autocomplete="cc-exp-year", in this case)—almost no one has even heard of the proper autocomplete markup here (I remember being in a conference room with two or three hundred other web developers a couple of years back, and the speaker asked who knew about autocomplete="new-pas…

I wonder how many of those devs use a password manager and just thought it was magic they didn't need to worry about when they were writing those kinds of forms.

I assumed that kind of markup had to exist, but its not my job to do web development at all, so time being finite, I'd never seen those. But I always assumed that they'd have to exist if I ever went looking. Why do people whose job it is to know these things not bother checking?

Re: Substack's UI and 1Password temporarily cost me $2k

#105

Post by ramraj07 »

TechBro8615 wrote: post #20

Yikes. I love my password manager, but I decided when I got it that I was never going to use the browser extensions. Putting your password manager anywhere near your web browser just seems like insanity to me (all the exploit write-ups I recall about password managers were related to browser extensions and sandbox escapes). This seems like another reason. It's not worth it. Keep the password manager in its own app an…

After learning about how every app in your PC has unfettered un monitored access to the clipboard why in gods name would you do that? I explicitly make a point to never copy any password to the clipboard!

Re: Substack's UI and 1Password temporarily cost me $2k

#106

Post by pimlottc »

Just wanted to add some detail on how the 1Password extension operates here, since the term "autofill" can be ambiguous:

1. The "autofill" function only fills in the credit number when the user specifically tells it to; it does not proactively fill forms with no user intervention.

2. "autofill" does not automatically submit the form after filling (although certain forms may be implemented to submit automatically once complete); in this particular case, the user still has a chance to review the completed form before manually clicking the subscribe button.

Re: Substack's UI and 1Password temporarily cost me $2k

#107

Post by MontagFTB »

ramraj07 wrote: post #105
TechBro8615 wrote: post #20

Yikes. I love my password manager, but I decided when I got it that I was never going to use the browser extensions. Putting your password manager anywhere near your web browser just seems like insanity to me (all the exploit write-ups I recall about password managers were related to browser extensions and sandbox escapes). This seems like another reason. It's not worth it. Keep the password manager in its own app an…

After learning about how every app in your PC has unfettered un monitored access to the clipboard why in gods name would you do that? I explicitly make a point to never copy any password to the clipboard!

Any password of sufficient strength would be slow and error-prone to copy manually. What’s the middle ground?

Re: Substack's UI and 1Password temporarily cost me $2k

#108

Post by MattGaiser »

enjoylife wrote: post #101
MattGaiser wrote: post #83

Earlier quoted context omitted.

This is probably so far down the list that I would be interested to hear of any kind of testing of extensions at all for non-extension companies.

Haven't seen this automated, but I have seen internal issues raised by folks within large orgs when their extension started breaking things. But it's only once you have 50+ to 100's of engineers working on a product, each with a subset of extensions installed, that you can rely on the cross product of engineers and their installed extensions for realistic coverage.

I've never worked on a team of more than 7 on a product, so even testing on Firefox is considered too much work for testing.

Put in dollars, it probably costs 5-10 million a year (if not more) to test extensions even haphazardly.

Re: Substack's UI and 1Password temporarily cost me $2k

#109

Post by kalleboo »

nrmitchi wrote: post #31
IncRnd wrote: post #29

Earlier quoted context omitted.

1Pass can choose not to put CC information into hidden fields.

Looking at the screen cap, it's not actually a hidden form, as much as a form field styled to look like text.

Looking at the source of the actual page, it's very odd markup.

There's a real input field, and a hidden input field "on top of" each other. I guess one is the stylized user-interactive one of which the value gets normalized into cents into the hidden one?

   
   $
   
   
   /year
Post reply on HN