Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Substack's UI and 1Password temporarily cost me $2k

timmyomahony.com

Post reply on HN
Print view View original

181–190 of 278 posts

Re: Substack's UI and 1Password temporarily cost me $2k

#181

Post by rawoke083600 »

tweetle_beetle wrote: post #174
yoz-y wrote: post #159

Earlier quoted context omitted.

I have little faith site developers care about password managers. Many even try to block them from working due to some perceived notion that they are insecure.

I remember using a company-mandated pension website which required a very long password with a comprehensive selection of complexity requirements. To log in, the password had to be entered twice, but they had disabled the ability to use a password manager to populate them (I forget the exact mechanism). To me this is the worst of all worlds. If you put people off using your website, you are less likely to have breach…

PeopleSoft ? (Poephol-Soft in dutch/afrikaans) as we used to call it !

Re: Substack's UI and 1Password temporarily cost me $2k

#183

Post by robertlagrant »

SulphurCrested wrote: post #152

This is an example of a common antipattern in software: some piece of software fails to correctly implement something (here, modern HTML autocomplete="cc-exp-year"), and another piece of software goes through all kinds of contortions to work with incorrect or incomplete implementations with the result that it now behaves undesirably with a third piece of software. Specifically, 1Password has to do complicated guesses…

> if password managers simply refused to autofill to any field other than the one with the matching standard autocomplete attribute, web developers might start doing the right thing

This is a market problem. All but the last password manager to do this would go out of business, due to reduced utility vs alternatives.

Re: Substack's UI and 1Password temporarily cost me $2k

#184

Post by xuki »

rawoke083600 wrote: post #182

Honest Question: Why do you guys use PW and not just Chrome build-in pw ? Assuming you neutral or not anti-google in the first place.

What if I want to use another browser? What if I want to use the same password on my iPhone? What if I manage a team and need to share certain passwords with my teammates?

Re: Substack's UI and 1Password temporarily cost me $2k

#185

Post by raesene9 »

progx wrote: post #163

Did anyone try to set -100 Dollar? ;-)

That was my first thought, where's the server-side validation that the amount submitted is in-line with what the UI showed. In this case it was higher than the UI stated, but what happens if it was lower...

Re: Substack's UI and 1Password temporarily cost me $2k

#186

Post by this_was_posted »

I see a lot of comments blaming either substack or 1password, but to me it seems the archaic transaction method of credit cards deserves most of the blame for these kinds of problems.

If the transaction authentication takes place on a separate page hosted by your own bank (so after the amount has been finalised) these kinds of mistakes can't happen. Unless the user neglects to look at the shown amount, but then the user is clearly at fault.

Re: Substack's UI and 1Password temporarily cost me $2k

#187

Post by chedabob »

EveYoung wrote: post #180
tweetle_beetle wrote: post #174

Earlier quoted context omitted.

I remember using a company-mandated pension website which required a very long password with a comprehensive selection of complexity requirements. To log in, the password had to be entered twice, but they had disabled the ability to use a password manager to populate them (I forget the exact mechanism). To me this is the worst of all worlds. If you put people off using your website, you are less likely to have breach…

My broker asks for 4-5 random letters of my password each time, making password managers unusable as well. Thinking about it now, how would you encrypt a password using this method? Create hashes of every combination?

Possibly using this? https://en.wikipedia.org/wiki/Shamir%27s_Secret_Sharing

I think a lot of implementations don't do anything clever and just have a fixed set of combinations they use each time, so the number of stored hashes is smaller.

Re: Substack's UI and 1Password temporarily cost me $2k

#188

Post by pnt12 »

rawoke083600 wrote: post #182

Honest Question: Why do you guys use PW and not just Chrome build-in pw ? Assuming you neutral or not anti-google in the first place.

It can't login to other applications, such as steam and discord clients.

It can't create passwords based on random words. If for some reason I can't use the password manager directly, I Can quickly check that the password is staples-horse-battery-correct and type it manually.

(I'm a Firefox user using keepassXC, but it's basically the same situation)

Re: Substack's UI and 1Password temporarily cost me $2k

#189

Post by colejohnson66 »

EveYoung wrote: post #180
tweetle_beetle wrote: post #174

Earlier quoted context omitted.

I remember using a company-mandated pension website which required a very long password with a comprehensive selection of complexity requirements. To log in, the password had to be entered twice, but they had disabled the ability to use a password manager to populate them (I forget the exact mechanism). To me this is the worst of all worlds. If you put people off using your website, you are less likely to have breach…

My broker asks for 4-5 random letters of my password each time, making password managers unusable as well. Thinking about it now, how would you encrypt a password using this method? Create hashes of every combination?

You can, but I’d assume they don’t. Plain text all the way!

Ok, yes. Encryption could work, but encrypted passwords aren’t much better than plain text ones.

Re: Substack's UI and 1Password temporarily cost me $2k

#190

Post by vintagedave »

It was not expensive, merely inconvenient, but 1Password and Waze combined to give me a two hours of frustration in December. At the end I went back to the beginning and reported the experience here. I wrote on twitter,

"Let's follow a trail of really Bad Tech Decisions between Waze and 1Password."

-- https://twitter.com/cpp_delphi_dave/status/13356390392953036... to read more. It's short.

Of the two, 1Password did reach out, but Support emails went nowhere. Waze never reached out at all.

Post reply on HN