Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Safari tries to fill username

github.com

Post reply on HN
Print view View original

161–170 of 393 posts

Re: Safari tries to fill username

#161

Post by cm2187 »

dkdbejwi383 wrote: post #120
izacus wrote: post #62

Earlier quoted context omitted.

Oh man, enterprise "security" firms used by banks and other old behemoths are a cancer for users. If you want your website to actively abuse users (especially one with special needs and pretty much anyone that doesn't fit into an "made up average person mold") get those people on board and listen to the dumb things they say. I still can't believe that whole business managed to interpret 2FA for whole EU as "you MUST…

The product I work on now logs users out after 15 minutes. It's a service where the average user would probably spend a good few hours of their day. We're actively harming the user experience (and driving paying customers away) because of some "expert" advice.

The ones that puzzle me even more are the intranet websites that log you off after x minutes whereas they work with single sign on, ie no password entered, so not sure what security benefit that achieves. But they make you lose whatever you were doing in the process.

Re: Safari tries to fill username

#162

Post by HatchedLake721 »

saagarjha wrote: post #130
HatchedLake721 wrote: post #61

Earlier quoted context omitted.

And these are "total nonsense" for you? - SVG background issue from 2016. Tested on my Safari Tech Preview 113 (Sep 2020), can't replicate. - Clicking issue. This is related to mouse event bubbling on iOS only (will affect both Safari and Chrome since they both use the same WebView). It's theorised that Apple set a specific set of rules when mouse events (on touch devices) will bubble up for performance/usability. Or…

Why are you running a Safari Technology Preview from last year?

I'm still on macOS Catalina. To upgrade the Safari Technology Preview, it wants Big Sur first and I just haven't got to upgrading my dev laptop yet. Something to do this weekend then!

Re: Safari tries to fill username

#163

Post by jokethrowaway »

izacus wrote: post #97
thaumasiotes wrote: post #70

Earlier quoted context omitted.

> I still can't believe that whole business managed to interpret 2FA for whole EU as "you MUST use SMS for 2FA!". Weeeeeelll... I'm familiar with two (2) common kinds of "2FA" implementations. TOTP and SMS. Of those two, only SMS is actually a second factor, albeit not a particularly secure one. TOTP is fundamentally a password, and two passwords are no different than one password.

The issue was that it was ONLY SMS - they immediately deprecated private certificates, 2FA "calculators" and other 2FA schemes. After the security backlash they now backpedaled and implemented 2FA with ONLY apps. Apps that ONLY work on iOS and Google Android. I had endless calls from family where they couldn't access their banks anymore because they had a Huawei phone or a dumb phone. Banks are citing "security" as e…

Noticed this as well.

It's a minor inconvenience for someone who is organised or is used to store secretes securely but a complete nightmare (including a security nightmare) for your average Joe.

Thanks EU, thanks governments for your precious regulations that keep us safe.

I wonder how many similar stories there are in fields I'm not an expert of.

Re: Safari tries to fill username

#164

Post by danaris »

rimliu wrote: post #64
rashil2000 wrote: post #17

Earlier quoted context omitted.

No, but Safari routinely causes many problems that seem utterly basic for Firefox/Chrome.

Because you develop on Chrome, and only occasionally test on Safari. Try the other way around and see which one is buggy.

I think this really needs to be emphasized strongly.

I develop primarily on Safari, and only occasionally test on Chrome (for my hobby side project), and occasionally I run into instances where Chrome differs. To me, those look like Chrome bugs because Safari is my "default".

If you're using Chrome (or Firefox, which, in my recent experience, tries specifically to be compatible with Chrome because Chrome is the overwhelming default for people like IE was) primarily, and expecting Safari to exactly match its behavior, of course you'll run into various cases where Safari appears buggy. But to use that to claim that Safari is "the new IE6" is just ludicrous.

I don't know how old other people in this thread are—maybe those making the comparison to Safari weren't actually around for the IE era, or maybe it's just been so long you've forgotten how bad it really was—but I was actually doing some web development back when IE6 and even IE4 were common. They were an absolute nightmare. I don't recall the precise details at this late date, but there were fairly basic HTML tags they didn't implement, and others they implemented completely differently. Javascript features were all over the map.

That realusername has to dig up four fairly esoteric edge-case issues to show that Safari is "total nonsense", and then have HatchedLake point out that at least two of those aren't even current, is ample proof that it's the comparison of IE to Safari that's total nonsense.

Re: Safari tries to fill username

#165

Post by kenniskrag »

dkdbejwi383 wrote: post #120
izacus wrote: post #62

Earlier quoted context omitted.

Oh man, enterprise "security" firms used by banks and other old behemoths are a cancer for users. If you want your website to actively abuse users (especially one with special needs and pretty much anyone that doesn't fit into an "made up average person mold") get those people on board and listen to the dumb things they say. I still can't believe that whole business managed to interpret 2FA for whole EU as "you MUST…

The product I work on now logs users out after 15 minutes. It's a service where the average user would probably spend a good few hours of their day. We're actively harming the user experience (and driving paying customers away) because of some "expert" advice.

imho better would be if the site just asks for the 2fa again after sending the form.

Re: Safari tries to fill username

#166

Post by ta89489544 »

Mordisquitos wrote: post #111
kikoreis wrote: post #90

Earlier quoted context omitted.

Yes, but let's be fair, it's a galaxy better than writing it on a post-it or password booklet, and still way better than using a memorable passphrase which will get reused and then leaked. Besides, you can encrypt the local storage with a master password (and if you accept online as a requirement, you could even add 2FA to that).

A (well handled) physical password booklet is much more secure for the average home user, who is unlikely to ever be individually targetted by a third party attacker, let alone to the level of the attacker physically breaking into their home. My parents being victims of a zero-day vulnerability or installing a malicious application by mistake are much more realistic scenarios than their house being broken into and th…

A password booklet works well at home, but it's obviously much less secure if you wanted to sign in to a service while in public on your phone for example. One of the major benefits of a password manager is that your passwords are present, encrypted, on all of the device you need them on. Most people don't only need passwords at home, so the odds of theft or loss of the password book are much higher than your example makes it out to be. If we're talking about an average user, the solution of only sign into services at home isn't really an option.

Re: Safari tries to fill username

#167

Post by cmeacham98 »

izacus wrote: post #97
thaumasiotes wrote: post #70

Earlier quoted context omitted.

> I still can't believe that whole business managed to interpret 2FA for whole EU as "you MUST use SMS for 2FA!". Weeeeeelll... I'm familiar with two (2) common kinds of "2FA" implementations. TOTP and SMS. Of those two, only SMS is actually a second factor, albeit not a particularly secure one. TOTP is fundamentally a password, and two passwords are no different than one password.

The issue was that it was ONLY SMS - they immediately deprecated private certificates, 2FA "calculators" and other 2FA schemes. After the security backlash they now backpedaled and implemented 2FA with ONLY apps. Apps that ONLY work on iOS and Google Android. I had endless calls from family where they couldn't access their banks anymore because they had a Huawei phone or a dumb phone. Banks are citing "security" as e…

My bank (one of the largest in the US) supports 2FA with SMS, their app, or a physical hardware token (which you buy from them for $20).

Re: Safari tries to fill username

#168

Post by zwily »

rimliu wrote: post #65
bryanrasmussen wrote: post #25

Earlier quoted context omitted.

so - is this your defense of IE11 as well? There are several questions regarding bugs - how many are there, how difficult are they to find, how difficult are they to fix. It seems that there are many Safari bugs that are difficult to find, and to fix, which makes them worse than other browsers. In this case I believe the bug is actually difficult to find, this guy found it but I bet a lot of developers just went and…

I am not defending anything. Just wondering. I have literally decades of the web dev experience, I had to do pixel perfect CSS layouts for IE5. These comparisons are stupid beyond belief.

Yeah, I suspect the people saying Safari is the new IE didn’t actually have to really support an old IE version 15 years ago. It’s really not comparable.

Re: Safari tries to fill username

#169

Post by toyg »

KMag wrote: post #149
batch12 wrote: post #108

Earlier quoted context omitted.

There are authentication mechanisms that rely on passwords but work by not transmitting the password too. One example is kerberos. TOTP is a password. The fact that it is a password doesn't matter though since it is something you have (and can't know) which augments the something you know. This satisfies the intent of MFA.

> One example is kerberos. It kills me that most enterprise environments use Kerberos via Active Directory, LDAP, or NIS. So, your workstation probably has Kerberos tickets sitting on it, which would allow very light weight 2-way authentication and encryption of internal flows. TLS client certificates and TLS-everywhere would be another good option, but it's particularly frustrating that the Kerberos TGTs are already…

I agree Kerberos is somewhat under-used, but man isn't it half a pain to set up integrations with...

Part of the problem is that it's "enterprise" tech, which means all sorts of "enterprise" middleware claims to support it with some half-assed concoction that worked on the presales demo environment once, back in 2001, and nobody else has touched since. And it's also old and pretty obscure, with documentation lost to the fog of time, and very few people who remember how it was supposed to work - a bit like MS DCOM...

Re: Safari tries to fill username

#170

Post by HatchedLake721 »

1337shadow wrote: post #23
Tokelin wrote: post #3

Earlier quoted context omitted.

Looks more and more like Safari is the "modern" IE

As a webdev I can confirm that I have exactly the same experience supporting Safari that I had supporting IE 15 years ago.

Can you share details?
Post reply on HN