Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Safari tries to fill username

github.com

Post reply on HN
Print view View original

171–180 of 393 posts

Re: Safari tries to fill username

#171

Post by zwily »

reynard_le_faux wrote: post #9
captainmuon wrote: post #5

Too much magic if you ask me. There are often two ways you can do something. In this case: - Explicit clean markup and a deterministic GUI or - Tons of heuristics and a magic GUI that works great most of the time but fails in ways that are hard to understand. I feel you get this tradeoff a lot in "clever" systems. Whether it is just finding the main text on a page, blocking ads, doing search, or even self-driving car…

In my opinion Safari is way too aggressive with filling usernames and passwords. Anything in any way similarly named like these it forces an autofill. And of course it overrides autocomplete="off". We definitely need an attribute that implies, "I actually know what I'm doing Safari! Please really don't autofill this."

If that attribute existed, security audits would again force big enterprises to enable it to break auto fill on their password fields, taking us back to square one.

Re: Safari tries to fill username

#173

Post by Aeolun »

mjthompson wrote: post #39
yvoschaap wrote: post #18

Earlier quoted context omitted.

Yes. The Chrome devs refuse to accept there are viable cases for not allowing autocomplete.

I'm sure there are valid reasons. Unfortunately, many sites disable it without a good reason, and in those cases, I am glad Chrome hinders their misguided efforts. Many banks, for instance, think password managers are bad and disable it. Chrome preventing them doing so is a good thing.

I do not. Ultimately it is up to the website owners, it shouldn’t be ignored by the browser if it’s part of the spec.

Re: Safari tries to fill username

#174

Post by Aeolun »

bipson wrote: post #38
vincnetas wrote: post #33

Earlier quoted context omitted.

It's not up to Chrome devs to accept or deny viable use cases. As someone from comments mentions, it's in the spec, and chrome devs should not deviate from that irrelevant if what they think is accepted or not accepted use case. Or they should go and push for spec change.

I guess there are just too many pages that break autocomplete, e.g. for username/password as a "security feature". I encountered quite a few myself and was very annoyed. I guess devs took the "usability" side of the question. EDIT: phrasing

But it’s not useable at all. A form without autocomplete is perfectly useable. A form with autocomplete where it’s not wanted is an absolute hindrance.

Re: Safari tries to fill username

#175

Post by Aeolun »

ossopite wrote: post #152
orangepanda wrote: post #47

Earlier quoted context omitted.

Are there any viable cases?

Any business SaaS app where users like customer service representatives input data about their customers. Name, address, email, payment information and so on. Under no circumstances should these sort of input fields be autofilled.

Or the data stored in the CSR browser history.

Re: Safari tries to fill username

#176

Post by cactus2093 »

Cthulhu_ wrote: post #131
dkdbejwi383 wrote: post #120

Earlier quoted context omitted.

The product I work on now logs users out after 15 minutes. It's a service where the average user would probably spend a good few hours of their day. We're actively harming the user experience (and driving paying customers away) because of some "expert" advice.

After 15 minutes, or 15 minutes of inactivity? The latter is defensible at least, in e.g. a public area where there is a risk of people leaving their desktops without locking them. I mean that's another policy issue that can be addressed (a policy that locks a system after x amount of inactivity), but as an app developer you can't know much about the system things are running on.

But should all sites really be optimized for the user at a public library computer? At the expense of convenience for the large majority of users that are on a personal or work computer? Doesn’t make much sense to me.

Also the computer itself solves this problem for you in many cases, a guest profile typically deletes all browser session info when you log out.

Re: Safari tries to fill username

#178

Post by kordlessagain »

ChrisMarshallNY wrote: post #103

I don't see this as a bug. Password autocomplete is kind of a dumpster fire. It varies, depending on which sites I visit. I use 1Password, with browser integrations (it works better with Safari than Chrome). I don't know most of my passwords; relying on 1Password to access the strings of garbage I autogenerate. So I am constantly using it to fill forms. It keys on things like attached ... elements. Not all sites use…

> I don't know most of my passwords; relying on 1Password to access the strings of garbage I autogenerate.

This is more likely normal behavior than abnormal. The number of sites a person uses likely increases the chances they don't actually know most of their passwords. The default "flow" becomes "password reset and recovery", which makes most services about a secure as the system being used for recovery if the password is reset.

It's important to understand the value of the data or service being "protected" by authentication. Banks should probably continue using passwords. Bookmarking sites, or things like Discord can get away with token logins. This eases the burden on the user.

Gmail leaves me logged in for long periods of time once I've authenticated on a given machine/browser. This is also a form of "autocompletion" in a way, allowing me to access sensitive data (my email) without having to re-authenticate with a password (by using a stored cookie). Anything using my email for password recovery is susceptible to being attacked through my persistent session, but then again I do a pretty decent job of retaining possession of my laptop physically.

By using email tokens to log in to a site, instead of resetting a password that will likely be forgotten, one could just skip straight to logging in the user with the one time tokens, which are as secure as the system being used for transmitting the token.

Re: Safari tries to fill username

#179

Post by noja »

Aeolun wrote: post #173
mjthompson wrote: post #39

Earlier quoted context omitted.

I'm sure there are valid reasons. Unfortunately, many sites disable it without a good reason, and in those cases, I am glad Chrome hinders their misguided efforts. Many banks, for instance, think password managers are bad and disable it. Chrome preventing them doing so is a good thing.

I do not. Ultimately it is up to the website owners, it shouldn’t be ignored by the browser if it’s part of the spec.

Why do you think it is up to website owners, and not website users?

Re: Safari tries to fill username

#180

Post by matsemann »

realusername wrote: post #45
eitland wrote: post #35

Earlier quoted context omitted.

No. This is a small but important detail: Chrome is the new IE. IE wasn't mainly a problem because it didn't support things, rather because it was - in the beginning - superior, but also had all sorts of non standard behaviour that Microsoft pushed and that made competition crazy hard. Oh, and also because they pushed it relentlessly in all ways including - as was later confirmed in court - illegal ways. Exactly like…

> No. This is a small but important detail: Chrome is the new IE. In terms of market share and market power yes it's comparable, in term of tech issues, not really no, it's not even close. Chrome has a very good rendering engine, there's a few quirks here and there, I might have encountered some strange logic once or twice but that's about it. Safari on the other hand is really comparable in terms of tech issues and…

> in term of tech issues, not really no, it's not even close

It's not about tech issues. It's about pushing non-standard behavior. There are so many things Chrome implement and people start using, that other browsers have then to call them "standard" and make a similar implementation.

But even worse, since Google also is controlling some of the biggest websites, they can use this functionality and cripple other browsers for not supporting their "standards". Like YT has been horrendously slow on Fx for years. Not based on Fx being slow, but YT having implementation details that happen to work well on their own browser..

Post reply on HN