Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Safari tries to fill username

github.com

Post reply on HN
Print view View original

131–140 of 393 posts

Re: Safari tries to fill username

#131

Post by Cthulhu_ »

dkdbejwi383 wrote: post #120
izacus wrote: post #62

Earlier quoted context omitted.

Oh man, enterprise "security" firms used by banks and other old behemoths are a cancer for users. If you want your website to actively abuse users (especially one with special needs and pretty much anyone that doesn't fit into an "made up average person mold") get those people on board and listen to the dumb things they say. I still can't believe that whole business managed to interpret 2FA for whole EU as "you MUST…

The product I work on now logs users out after 15 minutes. It's a service where the average user would probably spend a good few hours of their day. We're actively harming the user experience (and driving paying customers away) because of some "expert" advice.

After 15 minutes, or 15 minutes of inactivity? The latter is defensible at least, in e.g. a public area where there is a risk of people leaving their desktops without locking them. I mean that's another policy issue that can be addressed (a policy that locks a system after x amount of inactivity), but as an app developer you can't know much about the system things are running on.

Re: Safari tries to fill username

#132

Post by madeofpalk »

fvold wrote: post #72
alisonkisk wrote: post #24

Earlier quoted context omitted.

Safari doesn't write the HTML, and web page authors don't write explicit clean markup, so the pedestrian approach doesn't work in the real world.

I wonder what would happen if compilers/interpreters/lexers of various programming/scripting languages had this attitude. Why do web page authors get a pass? I mean, most web page authors today at least also do JavaScript, where a single out-of-place character can cause the whole thing to simply break. Yeah yeah, legacy and all that, but that's why we have doctypes.

> Why do web page authors get a pass?

It's not that web developers get a pass, but that browsers want to add complete features that help its users. They're dealing with the reality of the long tail of websites that exist and trying to make their users happy.

Re: Safari tries to fill username

#133

Post by bengale »

HatchedLake721 wrote: post #61
realusername wrote: post #8

Earlier quoted context omitted.

Like SVG background issues https://stackoverflow.com/questions/40986798/repeated-svg-ba... clicking issues https://stackoverflow.com/questions/24077725/mobile-safari-s... (yeah even clicks are broken) background jank https://stackoverflow.com/questions/9983520/webkit-animation... (not sure it's exactly this bug but I do have fixes in the codebase for that) round corners https://stackoverflow.com/questions/50995411/ca…

And these are "total nonsense" for you? - SVG background issue from 2016. Tested on my Safari Tech Preview 113 (Sep 2020), can't replicate. - Clicking issue. This is related to mouse event bubbling on iOS only (will affect both Safari and Chrome since they both use the same WebView). It's theorised that Apple set a specific set of rules when mouse events (on touch devices) will bubble up for performance/usability. Or…

Our web app has a single safari exception in the CSS and I'm pretty sure it's fixed in the latest version, just waiting for it to be more widely updated on peoples machines.

Re: Safari tries to fill username

#134

Post by Deestan »

andylynch wrote: post #114
mjthompson wrote: post #39

Earlier quoted context omitted.

I'm sure there are valid reasons. Unfortunately, many sites disable it without a good reason, and in those cases, I am glad Chrome hinders their misguided efforts. Many banks, for instance, think password managers are bad and disable it. Chrome preventing them doing so is a good thing.

They can be persuaded to change these policies. Asking why they aren’t following the current NIST (US) or NCSC (GB) password guidelines is helpful.

I can't persuade my bank to revisit their security decisions in any reasonable time frame or within any reasonable amount of effort.

Re: Safari tries to fill username

#135

Post by technion »

Lex-2008 wrote: post #49
orangepanda wrote: post #47

Earlier quoted context omitted.

Are there any viable cases?

OTP one-time-password fields

Every time I logon to a certain system, Bitwarden types my password then I get a TOTP prompt. And it offers a pulldown menu half a screen long of previously entered codes.

Re: Safari tries to fill username

#137

Post by noAnswer »

izacus wrote: post #97
thaumasiotes wrote: post #70

Earlier quoted context omitted.

> I still can't believe that whole business managed to interpret 2FA for whole EU as "you MUST use SMS for 2FA!". Weeeeeelll... I'm familiar with two (2) common kinds of "2FA" implementations. TOTP and SMS. Of those two, only SMS is actually a second factor, albeit not a particularly secure one. TOTP is fundamentally a password, and two passwords are no different than one password.

The issue was that it was ONLY SMS - they immediately deprecated private certificates, 2FA "calculators" and other 2FA schemes. After the security backlash they now backpedaled and implemented 2FA with ONLY apps. Apps that ONLY work on iOS and Google Android. I had endless calls from family where they couldn't access their banks anymore because they had a Huawei phone or a dumb phone. Banks are citing "security" as e…

> The funny part is - ALL banks did this at once.

What country are you taking about? In regards to the EU 2FA thingy I start to belief to see a pattern. In countries who had established online banking standards with 2FA, nothing changed. But countries without, went ballistic. SMS or App only 2FA on every login and on every transaction. Yah, I can see that this is annoying.

While for me with my German banks I still access them using the FinTS protocol with a banking software of my choosing. For transaction above 20€* I need a TAN from my chipTAN/Sm@rt-TAN device (Which shows you the transaction details). Optional I could choose an app. SMS was phased out years ago (By my banks. Others perhaps still have it.)

(*only 3 transaction a day I believe. You can deactivate that so that you get asked for a TAN every time.)

Re: Safari tries to fill username

#138

Post by gvx »

niek_pas wrote: post #55
GistNoesis wrote: post #32

Does it work in other languages ?

Just tested it in Dutch ("Welkom terug"), which does not trigger the autocomplete.

Is the Safari UI in Dutch for you? (I never set UI language to Dutch if I can avoid it even though it's my native language, the localization is often so clunky that I find it distracting)

Re: Safari tries to fill username

#139

Post by realusername »

HatchedLake721 wrote: post #61
realusername wrote: post #8

Earlier quoted context omitted.

Like SVG background issues https://stackoverflow.com/questions/40986798/repeated-svg-ba... clicking issues https://stackoverflow.com/questions/24077725/mobile-safari-s... (yeah even clicks are broken) background jank https://stackoverflow.com/questions/9983520/webkit-animation... (not sure it's exactly this bug but I do have fixes in the codebase for that) round corners https://stackoverflow.com/questions/50995411/ca…

And these are "total nonsense" for you? - SVG background issue from 2016. Tested on my Safari Tech Preview 113 (Sep 2020), can't replicate. - Clicking issue. This is related to mouse event bubbling on iOS only (will affect both Safari and Chrome since they both use the same WebView). It's theorised that Apple set a specific set of rules when mouse events (on touch devices) will bubble up for performance/usability. Or…

You are right, those bugs are very old but the desktop bugs mentionned are still replicable on Safari 13 at least, the iOS bug is at least replicable in iOS 13 and I have no reason to think it's fixed (yes you are right, this click bug has been there since 2012 at least, that's been 9 years now).

> I primarily use Safari for privacy/battery/performance reasons, and on my web app of 2 years with tons of styling I have 5 lines of scss code with "// safari" comment to make some elements render the same as Chrome.

You are within your own right to use Safari but you should not expect everything to work perfectly in return, treat it as "best effort" web browsing.

On my case I have about a dozen lines of CSS and same in JS for all the Safari quirks. All of those took time to investigate and fix (especially with their awful debugger...), maybe there's more Safari bugs, I just cannot guarantee everything works.

Post reply on HN