Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Safari tries to fill username

github.com

Post reply on HN
Print view View original

101–110 of 393 posts

Re: Safari tries to fill username

#101

Post by judge2020 »

tomcooks wrote: post #93

Anything but following standards and making sure that upon joining the internet new users either know how to use the tools, or know what the consequences can be. I miss netiquette and RTFM

That was a time of the internet being a ‘nerd’ thing and using it took intrigue into how it works alongside how to use it. Now quite literally more than half the planet needs to use it since it allows instant communication and you can’t expect everybody (or even most people) to spend the time to learn how it works when they can just chalk it up to ‘magic’ and continue with their life.

Re: Safari tries to fill username

#102

Post by batch12 »

thaumasiotes wrote: post #87
lucideer wrote: post #86

Earlier quoted context omitted.

> TOTP is fundamentally a password I see this view a lot. It's wrong. TOTP is fundamentally different to a password, as the stored "password" (by which I presume you mean the key) is never transmitted anywhere. TOTP in fact has one property that makes it potentially* the most secure of all 2FA methods: it can be used airgapped. As the credential you type into the 2FA form is not the saved secret. * I say "potentially…

> TOTP is fundamentally different to a password, as the stored "password" (by which I presume you mean the key) is never transmitted anywhere. Are you familiar with SRP? TOTP has all of the properties of passwords, and no properties that passwords don't have. That makes it... a password.

Yeah, TOTP is a password. Hell, it is in the name. One property it has that differs from classic passwords is the authentication factor. For TOTP, it changes from something you know you something you have. However, lots of passwords are now randomly generated and are no longer "something you know" either.

Re: Safari tries to fill username

#103

Post by ChrisMarshallNY »

I don't see this as a bug. Password autocomplete is kind of a dumpster fire. It varies, depending on which sites I visit.

I use 1Password, with browser integrations (it works better with Safari than Chrome).

I don't know most of my passwords; relying on 1Password to access the strings of garbage I autogenerate.

So I am constantly using it to fill forms.

It keys on things like attached ... elements. Not all sites use these. Some sites also sometimes add some kind of junk that causes 1Password to fail.

Other times, 1Password insists that the field I just selected needs an autofill; even for non-auth fields.

Not really a big deal for me. No one that shouldn't gets my auth, and I ignore the prompt when it is not necessary.

Re: Safari tries to fill username

#104

Post by tremon »

thaumasiotes wrote: post #96
jimktrains2 wrote: post #88

Earlier quoted context omitted.

A password is something you're supposed to "know", i.e. something in your head. A second factor is something you have, i.e. your phone, a hardware token, or access to a shared secret you don't store in your head. Password managers kind of mangle the idea and turn the password from something you know to something you have.

A password is information, something that can be freely duplicated. The idea of "something you have" is that the thing can't be duplicated. As soon as it can, it's no longer "something you have". Any number of people might have it. A person who has it might not be you. SMS hijacking, for example, converts your phone-based authentication to a password, where the password is your phone number. (Since an attacker who kn…

Yes, it starts its life as a password. After that, it is never communicated ever again, and therefore, after the initial exchange, it's something you have.

It seems to me you are ascribing properties to "something you have" that aren't warranted. The "something you have" needs to prove you were party to the initial exchange, not necessarily that you were the only one present -- that's why we use two factors, and not only TOTP.

Re: Safari tries to fill username

#107

Post by teknopaul »

m-p-3 wrote: post #98
kikoreis wrote: post #90

Earlier quoted context omitted.

Yes, but let's be fair, it's a galaxy better than writing it on a post-it or password booklet, and still way better than using a memorable passphrase which will get reused and then leaked. Besides, you can encrypt the local storage with a master password (and if you accept online as a requirement, you could even add 2FA to that).

The password booklet can be secure if you have good physical security, and is immune to a software zero-day and autocomplete exploits.

this x 10, computer security is usually flawed, personal security is (bar a few war zones) much better.

Re: Safari tries to fill username

#108

Post by batch12 »

lucideer wrote: post #94
thaumasiotes wrote: post #87

Earlier quoted context omitted.

> TOTP is fundamentally different to a password, as the stored "password" (by which I presume you mean the key) is never transmitted anywhere. Are you familiar with SRP? TOTP has all of the properties of passwords, and no properties that passwords don't have. That makes it... a password.

I guess you can argue the definition of the word "password"; language is fluid, especially English. I would say SRP is strictly a misnomer (though it's a useful conflation). Generally speaking password is a value provided for authentication (if it's no longer being "provided", as in SRP, it's something different... but I understand using a familiar word for that something different is helpful when communicating). Eit…

There are authentication mechanisms that rely on passwords but work by not transmitting the password too. One example is kerberos.

TOTP is a password. The fact that it is a password doesn't matter though since it is something you have (and can't know) which augments the something you know. This satisfies the intent of MFA.

Re: Safari tries to fill username

#109

Post by im3w1l »

thaumasiotes wrote: post #80
wffurr wrote: post #71

Earlier quoted context omitted.

Doesn’t answering a TOTP challenge prove that you “have” the HMAC shared key that seeds the code generator?

Yes, that shared key is a password, a piece of knowledge known in common between you and them.

The key thing is that an attacker wont be able to keylog the shared secret, or trick me into typing it on the wrong site.

Re: Safari tries to fill username

#110

Post by jsnell »

izacus wrote: post #97
thaumasiotes wrote: post #70

Earlier quoted context omitted.

> I still can't believe that whole business managed to interpret 2FA for whole EU as "you MUST use SMS for 2FA!". Weeeeeelll... I'm familiar with two (2) common kinds of "2FA" implementations. TOTP and SMS. Of those two, only SMS is actually a second factor, albeit not a particularly secure one. TOTP is fundamentally a password, and two passwords are no different than one password.

The issue was that it was ONLY SMS - they immediately deprecated private certificates, 2FA "calculators" and other 2FA schemes. After the security backlash they now backpedaled and implemented 2FA with ONLY apps. Apps that ONLY work on iOS and Google Android. I had endless calls from family where they couldn't access their banks anymore because they had a Huawei phone or a dumb phone. Banks are citing "security" as e…

The benefit of apps and SMS over hardware tokens, TOTP, smartcards, etc. is to have a out of band communications channel, not merely a second factor. This is crucial for dealing with malware that can change the transactions a user is entering on a banking site, and it being literally impossible for them to notice that it's happened just on the browser. With apps / SMS, they can be informed of the transaction details as part of the verification process on a secondary communications channel that hopefully is not affected by the malware.
Post reply on HN