Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Safari tries to fill username

github.com

Post reply on HN
Print view View original

121–130 of 393 posts

Re: Safari tries to fill username

#121

Post by lucideer »

batch12 wrote: post #102
thaumasiotes wrote: post #87

Earlier quoted context omitted.

> TOTP is fundamentally different to a password, as the stored "password" (by which I presume you mean the key) is never transmitted anywhere. Are you familiar with SRP? TOTP has all of the properties of passwords, and no properties that passwords don't have. That makes it... a password.

Yeah, TOTP is a password. Hell, it is in the name. One property it has that differs from classic passwords is the authentication factor. For TOTP, it changes from something you know you something you have. However, lots of passwords are now randomly generated and are no longer "something you know" either.

> it is in the name

The "Password" named in "Time-based One Time Password" is the temporary generated value you transmit. It's not what's stored on the TOTP device, so in the context of this discussion, that temp value isn't what the gp was referring to.

Re: Safari tries to fill username

#122

Post by bryanrasmussen »

kikoreis wrote: post #90
lmilcin wrote: post #76

Earlier quoted context omitted.

Autocomplete has one huge, glaring disadvantage: the passwords are stored on your computer, in reversible form.

Yes, but let's be fair, it's a galaxy better than writing it on a post-it or password booklet, and still way better than using a memorable passphrase which will get reused and then leaked. Besides, you can encrypt the local storage with a master password (and if you accept online as a requirement, you could even add 2FA to that).

>Yes, but let's be fair, it's a galaxy better than writing it on a post-it

the modern security hazard is not someone reading your post-it that is sitting on your desk, it is someone remotely getting access to some part of your computer or some service you own that can tell you what the password is.

The post-it note in our world is more secure than lots of things that have replaced it.

on edit: I see Mordisquitos said it better than I.

Re: Safari tries to fill username

#123

Post by thaumasiotes »

batch12 wrote: post #102
thaumasiotes wrote: post #87

Earlier quoted context omitted.

> TOTP is fundamentally different to a password, as the stored "password" (by which I presume you mean the key) is never transmitted anywhere. Are you familiar with SRP? TOTP has all of the properties of passwords, and no properties that passwords don't have. That makes it... a password.

Yeah, TOTP is a password. Hell, it is in the name. One property it has that differs from classic passwords is the authentication factor. For TOTP, it changes from something you know you something you have. However, lots of passwords are now randomly generated and are no longer "something you know" either.

> Yeah, TOTP is a password. Hell, it is in the name.

Careful; "one-time password" is in the name, and it certainly isn't that. Your TOTP seed stays valid forever.

Re: Safari tries to fill username

#124

Post by techrat »

ChrisMarshallNY wrote: post #103

I don't see this as a bug. Password autocomplete is kind of a dumpster fire. It varies, depending on which sites I visit. I use 1Password, with browser integrations (it works better with Safari than Chrome). I don't know most of my passwords; relying on 1Password to access the strings of garbage I autogenerate. So I am constantly using it to fill forms. It keys on things like attached ... elements. Not all sites use…

I use BitWarden and have come to prefer something about BitWarden that initially irked me coming from LastPass.

There is no icon in any of the fields to click to populate them.

There is no auto filling.

You have to cursor into the field, right click and manually select the relevant entry to fill.

From a security standpoint this is much better and safer overall.

It also prevents accidental autofilling and login of an account you're trying NOT to login with on sites where you have multiple accounts and need to keep things carefully separated.

Re: Safari tries to fill username

#125

Post by jimktrains2 »

teknopaul wrote: post #112
jimktrains2 wrote: post #92

Earlier quoted context omitted.

When you connect to a website with ssl, your sensitive data is transmitted in a reversible form as well. I believe moat browsers will use the system keyring (which is usually encrypted based on your login password or a tpm) if present or use a master password to encrypt them at rest.

Most websites are data sinks of anything that can be taken. No reason IMHO the login page should not always send a hash over ssl. (which is hashed again to test it)

I'm not sure what you mean by hash, but i6 think you're trying to describe mutual authentication, where the service also authenticates itself to the user. Look up things like pake, srp, and tls client certificates for more information.

https://en.m.wikipedia.org/wiki/Mutual_authentication

https://en.m.wikipedia.org/wiki/Secure_Remote_Password_proto...

https://en.m.wikipedia.org/wiki/Password-authenticated_key_a...

https://en.m.wikipedia.org/wiki/Client_certificate

Re: Safari tries to fill username

#126

Post by thaumasiotes »

Aeolun wrote: post #113
thaumasiotes wrote: post #87

Earlier quoted context omitted.

> TOTP is fundamentally different to a password, as the stored "password" (by which I presume you mean the key) is never transmitted anywhere. Are you familiar with SRP? TOTP has all of the properties of passwords, and no properties that passwords don't have. That makes it... a password.

Aside from the fact that I never transmit the actual password. So the password that you’d potentially get only works for you for 30 seconds. Slight detail that’s of course completely irrelevant.

> Aside from the fact that I never transmit the actual password.

You realize that, out of the many comments I've made in this tree, the one you responded to was the one that said

> Are you familiar with SRP?

There are more ways of compromising someone's information than capturing it in transit. If you give me your phone, I can read your TOTP seeds straight out of Google Authenticator.

Re: Safari tries to fill username

#127

Post by lloeki »

reynard_le_faux wrote: post #9
captainmuon wrote: post #5

Too much magic if you ask me. There are often two ways you can do something. In this case: - Explicit clean markup and a deterministic GUI or - Tons of heuristics and a magic GUI that works great most of the time but fails in ways that are hard to understand. I feel you get this tradeoff a lot in "clever" systems. Whether it is just finding the main text on a page, blocking ads, doing search, or even self-driving car…

In my opinion Safari is way too aggressive with filling usernames and passwords. Anything in any way similarly named like these it forces an autofill. And of course it overrides autocomplete="off". We definitely need an attribute that implies, "I actually know what I'm doing Safari! Please really don't autofill this."

Conversely, there are way too many websites that (intentionally or not) prevent password managers to function, which results in these kind of heuristics being implemented by password managers in order to be generally useful.

Re: Safari tries to fill username

#128

Post by saagarjha »

Lex-2008 wrote: post #50
reynard_le_faux wrote: post #30

Earlier quoted context omitted.

Safari also completely ignores autocomplete="off" when it thinks something is a username or password field. Even when, as a dev, I know it definitely isn't.

I assume you're not in Apple Store team, then. Because they do put autocomplete="off" on login form, username, and password fields. At least for me: https://imgur.com/a/Ygb371g UPDATE: please help me write a sarcastic comment about Apple Store team putting autocomplete="off" there, and Apple Safari browser ignoring it.

I honestly believe that some of the people that work on apple.com don't test the website in Safari.

Re: Safari tries to fill username

#129

Post by dzhiurgis »

I vaguely remember Apple saying they use ML to parse forms... Could be why.

Personally I have this weird thing with Safari passwords - there's 2 sites where password dropdown would appear at top left corner for whatever reason.

Re: Safari tries to fill username

#130

Post by saagarjha »

HatchedLake721 wrote: post #61
realusername wrote: post #8

Earlier quoted context omitted.

Like SVG background issues https://stackoverflow.com/questions/40986798/repeated-svg-ba... clicking issues https://stackoverflow.com/questions/24077725/mobile-safari-s... (yeah even clicks are broken) background jank https://stackoverflow.com/questions/9983520/webkit-animation... (not sure it's exactly this bug but I do have fixes in the codebase for that) round corners https://stackoverflow.com/questions/50995411/ca…

And these are "total nonsense" for you? - SVG background issue from 2016. Tested on my Safari Tech Preview 113 (Sep 2020), can't replicate. - Clicking issue. This is related to mouse event bubbling on iOS only (will affect both Safari and Chrome since they both use the same WebView). It's theorised that Apple set a specific set of rules when mouse events (on touch devices) will bubble up for performance/usability. Or…

Why are you running a Safari Technology Preview from last year?
Post reply on HN