Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Substack's UI and 1Password temporarily cost me $2k

timmyomahony.com

Post reply on HN
Print view View original

111–120 of 278 posts

Re: Substack's UI and 1Password temporarily cost me $2k

#111

Post by JohnTHaller »

MontagFTB wrote: post #107
ramraj07 wrote: post #105

Earlier quoted context omitted.

After learning about how every app in your PC has unfettered un monitored access to the clipboard why in gods name would you do that? I explicitly make a point to never copy any password to the clipboard!

Any password of sufficient strength would be slow and error-prone to copy manually. What’s the middle ground?

On a desktop, you can use KeePass and its variants to "auto-type". It'll switch focus to the last app you were in and type your username, a tab, your password, and then enter. No extensions or clipboard required. Just hit CTRL-SHIFT-V after highlighting the entry.

Re: Substack's UI and 1Password temporarily cost me $2k

#112

Post by kalleboo »

edaemon wrote: post #92
mbreese wrote: post #39

Earlier quoted context omitted.

It’s not “hidden” in the HTML form sense. It’s an input that is not styled as an obvious input field. The idea here is that if you want to, you can give the author more money as a “founding member”. You can the set the amount you’d like to give. It is visible to the user, but it isn’t obvious that this is an adjustable value at all (at least on mobile). There are a number of UX issues at play here... but a poorly sty…

It is hidden in the HTML form sense. It doesn't become visible to the user until you click the radio button.

That hidden input element contains the normalized value in cents, if that got filled out he would have only gotten charged $20. Right before it in the DOM is the stylized user-input field which does not get hidden (and populates the hidden field via JS)

Re: Substack's UI and 1Password temporarily cost me $2k

#113

Post by spideymans »

ramraj07 wrote: post #105
TechBro8615 wrote: post #20

Yikes. I love my password manager, but I decided when I got it that I was never going to use the browser extensions. Putting your password manager anywhere near your web browser just seems like insanity to me (all the exploit write-ups I recall about password managers were related to browser extensions and sandbox escapes). This seems like another reason. It's not worth it. Keep the password manager in its own app an…

After learning about how every app in your PC has unfettered un monitored access to the clipboard why in gods name would you do that? I explicitly make a point to never copy any password to the clipboard!

I'm still utterly perplexed about why every major operating system handles the clipboard this way. It's such an obvious privacy issue, and the fix seems really simple: only allow clipboard access when the user explicitly grants access through a system-provided user interface (whether that be a dialogue box, menu item or keyboard shortcut)

Apple's iOS 14 uses the half-solution of notifying the user after an application has read the clipboard. But at that point the end user is already a step behind the attacker, and mitigations may no longer be possible. Nevermind that this solution is dependant on the user noticing and understanding the implications of the clipboard access notification (the novice user is likely oblivious to the security risks)

Re: Substack's UI and 1Password temporarily cost me $2k

#114

Post by edoceo »

JohnTHaller wrote: post #111
MontagFTB wrote: post #107

Earlier quoted context omitted.

Any password of sufficient strength would be slow and error-prone to copy manually. What’s the middle ground?

On a desktop, you can use KeePass and its variants to "auto-type". It'll switch focus to the last app you were in and type your username, a tab, your password, and then enter. No extensions or clipboard required. Just hit CTRL-SHIFT-V after highlighting the entry.

That's paste

Re: Substack's UI and 1Password temporarily cost me $2k

#115

Post by edoceo »

MattGaiser wrote: post #108
enjoylife wrote: post #101

Earlier quoted context omitted.

Haven't seen this automated, but I have seen internal issues raised by folks within large orgs when their extension started breaking things. But it's only once you have 50+ to 100's of engineers working on a product, each with a subset of extensions installed, that you can rely on the cross product of engineers and their installed extensions for realistic coverage.

I've never worked on a team of more than 7 on a product, so even testing on Firefox is considered too much work for testing. Put in dollars, it probably costs 5-10 million a year (if not more) to test extensions even haphazardly.

I feel like I could get pretty far building this, with that budget.

Re: Substack's UI and 1Password temporarily cost me $2k

#116

Post by IncRnd »

chipotle_coyote wrote: post #63
IncRnd wrote: post #27

Earlier quoted context omitted.

The poor design and implementation of 1Password, you mean.

Speaking from personal experience -- over about six years at this point -- there are many, many web sites on the internets that 1Password's autofill works perfectly well on, and many others where it doesn't work perfectly but fails gracefully (or at least non-destructively). "Here is one site where it makes a mistake that could be catastrophic if you don't catch it" is just not a slam-dunk proof of 1Password being "p…

Ths is an appeal to authority. It is a shortcoming of the product's design for it to autofill a hidden field.

Re: Substack's UI and 1Password temporarily cost me $2k

#117

Post by [deleted] »

spideymans wrote: post #113
ramraj07 wrote: post #105

Earlier quoted context omitted.

After learning about how every app in your PC has unfettered un monitored access to the clipboard why in gods name would you do that? I explicitly make a point to never copy any password to the clipboard!

I'm still utterly perplexed about why every major operating system handles the clipboard this way. It's such an obvious privacy issue, and the fix seems really simple: only allow clipboard access when the user explicitly grants access through a system-provided user interface (whether that be a dialogue box, menu item or keyboard shortcut) Apple's iOS 14 uses the half-solution of notifying the user after an applicatio…

[deleted]

Re: Substack's UI and 1Password temporarily cost me $2k

#118

Post by hombre_fatal »

asiachick wrote: post #100
Cldfire wrote: post #98

Earlier quoted context omitted.

> One example is how almost every password manager including the built-in one in most browsers will assume that if there's a type="password" field, then the previous sibling field must be the username. Sometimes they'll even pick a field far away in the DOM like your chatbox input to autofill with the username. Note that this behavior is defined as part of the `autocomplete` standard. https://html.spec.whatwg.org/mul…

Yes, and the point of putting in the standard is so that it's documented how to author your website. Unfortunately, some not insignificant number of UI/UX designers want to push their special flow on users and so we get these incompatibilities. Hopefully the specs and expectations will evolve to the point that if your site doesn't follow the spec no one will use it. I can certainly imagine Apple/Google/Microsoft/Fire…

The spec is underspecified for basic edge cases, like any spec, and it's very hard to have implementation consensus.

This stuff is supposed to improve the UX. Yet the reality is that even when building basic forms, every website has to test and solve the sort of problems shown in TFA.

How much of the spec does every web developer in the world have to read to know that password managers should or shouldn't try to fill in credit card expiry/cvv in a hidden input? Does the spec even say anything about that? 1Password will ignore a `display: none`, by the way. Can this be quick-fixed by ensuring hidden inputs also have `display: none`? That's something every website trying to consider good autofill UX gets to figure out themselves if they even care.

Unfortunately "just follow the spec" does very little to block off the rabbit holes you'll find if you try to perfect UX on even basic forms, else I might agree with you.

Re: Substack's UI and 1Password temporarily cost me $2k

#119

Post by JimDabell »

bombcar wrote: post #85
chrismorgan wrote: post #77

Earlier quoted context omitted.

The problem is that all of these autofillers are already way too complex, because almost no one uses the optimal markup (adding the attribute autocomplete="cc-exp-year", in this case)—almost no one has even heard of the proper autocomplete markup here (I remember being in a conference room with two or three hundred other web developers a couple of years back, and the speaker asked who knew about autocomplete="new-pas…

Where are these various autocompletes detailed?

HTML 5.2 § 4.10.18.7. Autofill:

https://www.w3.org/TR/html52/sec-forms.html#sec-autofill

Re: Substack's UI and 1Password temporarily cost me $2k

#120

Post by sjs382 »

edoceo wrote: post #114
JohnTHaller wrote: post #111

Earlier quoted context omitted.

On a desktop, you can use KeePass and its variants to "auto-type". It'll switch focus to the last app you were in and type your username, a tab, your password, and then enter. No extensions or clipboard required. Just hit CTRL-SHIFT-V after highlighting the entry.

That's paste

It looks like paste and it's almost the same from the user perspective, but the data never makes it to the clipboard, where it would be available to every running application.
Post reply on HN