Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Substack's UI and 1Password temporarily cost me $2k

timmyomahony.com

Post reply on HN
Print view View original

141–150 of 278 posts

Re: Substack's UI and 1Password temporarily cost me $2k

#141

Post by jhanschoo »

reilly3000 wrote: post #127
flemhans wrote: post #40

Earlier quoted context omitted.

Yes, password managers are way safer than copy-pasting. You don't want something as sensitive as a password in your clipboard buffer, either.

Gah what then? I use strong passwords but almost all of them flow through my clipboard.

I a simple algorithm to generate a password based on the name of the service you are using, interleaved with a constant master password you remember. You can do the same thing with a password-manager password + clipboard, interleaved with a constant master password you remember, which should be even better.

Re: Substack's UI and 1Password temporarily cost me $2k

#142

Post by ludocode »

JohnTHaller wrote: post #111
MontagFTB wrote: post #107

Earlier quoted context omitted.

Any password of sufficient strength would be slow and error-prone to copy manually. What’s the middle ground?

On a desktop, you can use KeePass and its variants to "auto-type". It'll switch focus to the last app you were in and type your username, a tab, your password, and then enter. No extensions or clipboard required. Just hit CTRL-SHIFT-V after highlighting the entry.

I tried using this but the final "enter" made me too uncomfortable. I really wish it was optional so I could verify where it just typed the password before submitting. After accidentally sending my password in the wrong field/window a couple of times I stopped using it entirely. Now I just copy-paste :(

Re: Substack's UI and 1Password temporarily cost me $2k

#143

Post by gorkish »

pimlottc wrote: post #106

Just wanted to add some detail on how the 1Password extension operates here, since the term "autofill" can be ambiguous: 1. The "autofill" function only fills in the credit number when the user specifically tells it to; it does not proactively fill forms with no user intervention. 2. "autofill" does not automatically submit the form after filling (although certain forms may be implemented to submit automatically once…

All of this isn't particularly relevant if the function is abysmally terrible at filling the correct fields with the correct data, which in the case of 1Password certainly seems to be the case.

In the example posted here, it happily completed fields for the credit card expiration year TWICE on the same form, one of which was pre-populated with a value that could not possibly have been a year. The apparent cause is because the substring 'year' appeared in the field name. Levenshtein distance of 12 for a 4 letter word? Yep, looks good! I mean, it's a result so certain there's no need to prompt the user, highlight changed fields or anything, right?

Re: Substack's UI and 1Password temporarily cost me $2k

#144

Post by neya »

TechBro8615 wrote: post #20

Yikes. I love my password manager, but I decided when I got it that I was never going to use the browser extensions. Putting your password manager anywhere near your web browser just seems like insanity to me (all the exploit write-ups I recall about password managers were related to browser extensions and sandbox escapes). This seems like another reason. It's not worth it. Keep the password manager in its own app an…

I use Firefox's own password manager (https://www.mozilla.org/en-US/firefox/lockwise/) inbuilt into the browser. I think it's a better compromise than having to expose sensitive credentials into my clipboard. IT works across devices too, so there's no copy pasting on my Android device which god forbid is probably reading my clipboard too (I know Facebook used to do that).

I do not see a reason to copy paste in any use case at all.

Re: Substack's UI and 1Password temporarily cost me $2k

#145

Post by 3np »

reilly3000 wrote: post #127
flemhans wrote: post #40

Earlier quoted context omitted.

Yes, password managers are way safer than copy-pasting. You don't want something as sensitive as a password in your clipboard buffer, either.

Gah what then? I use strong passwords but almost all of them flow through my clipboard.

There are non-browser-extension password managers that still emulate you typing on your keyboard, rather than going through clipboard.

Personally I use rofi-pass to access GNU pass passwords (so just a hotkey and search for password name)

I'd warmly recommend it (or whatever other client you use for GNU pass) but I'm sure you can find similar functionality for any other decent password manager.

Re: Substack's UI and 1Password temporarily cost me $2k

#146

Post by 3np »

hombre_fatal wrote: post #52
TechBro8615 wrote: post #20

Yikes. I love my password manager, but I decided when I got it that I was never going to use the browser extensions. Putting your password manager anywhere near your web browser just seems like insanity to me (all the exploit write-ups I recall about password managers were related to browser extensions and sandbox escapes). This seems like another reason. It's not worth it. Keep the password manager in its own app an…

Password managers aren't nearly intelligent enough to be used without copy and paste for sensitive forms. One example is how almost every password manager including the built-in one in most browsers will assume that if there's a type="password" field, then the previous sibling field must be the username. Sometimes they'll even pick a field far away in the DOM like your chatbox input to autofill with the username. So…

You can still use something like passmenu[0] bundled with GNU pass, bind it to a hotkey and it fills it in as if you were typing on your keyboard, no clipboard involved.

[0] https://git.zx2c4.com/password-store/tree/contrib/dmenu/READ...

Re: Substack's UI and 1Password temporarily cost me $2k

#147

Post by Moeg »

ludocode wrote: post #142
JohnTHaller wrote: post #111

Earlier quoted context omitted.

On a desktop, you can use KeePass and its variants to "auto-type". It'll switch focus to the last app you were in and type your username, a tab, your password, and then enter. No extensions or clipboard required. Just hit CTRL-SHIFT-V after highlighting the entry.

I tried using this but the final "enter" made me too uncomfortable. I really wish it was optional so I could verify where it just typed the password before submitting. After accidentally sending my password in the wrong field/window a couple of times I stopped using it entirely. Now I just copy-paste :(

You can edit how and what KeePass types, I always remove the final enter for comfort and safety reasons.

Re: Substack's UI and 1Password temporarily cost me $2k

#148

Post by sjs382 »

shakna wrote: post #138
sjs382 wrote: post #120

Earlier quoted context omitted.

It looks like paste and it's almost the same from the user perspective, but the data never makes it to the clipboard, where it would be available to every running application.

From what I can see, KeePass does use the clipboard. [0] [0] https://github.com/dlech/KeePass2.x/blob/VS2019/KeePassLib/N...

Sorry, I didn't mean to speak with any authority on the specifics of KeePass. I'm neither a developer nor a user. I was just explaining the parent.

That said, the implementation probably differs on different platforms. 1Password, for example, uses a virtual "keyboard" on Android.

Re: Substack's UI and 1Password temporarily cost me $2k

#150

Post by abdullahkhalids »

reilly3000 wrote: post #127
flemhans wrote: post #40

Earlier quoted context omitted.

Yes, password managers are way safer than copy-pasting. You don't want something as sensitive as a password in your clipboard buffer, either.

Gah what then? I use strong passwords but almost all of them flow through my clipboard.

Some password managers will type the username/password into the browser (through a virtual keyboard I think), not copy-paste them to protect against clipboard attacks. Eg. Keepasssc
Post reply on HN