Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Somebody implemented something I wrote a blog about

news.ycombinator.com

Post reply on HN
Print view View original

181–190 of 253 posts

Re: Tell HN: Somebody implemented something I wrote a blog about

#181

Post by eek2121 »

levymetal wrote: post #149
spiffytech wrote: post #28

Years back, every web browser's built-in password manager locked up the page when submitting a login form, waiting for the user to answer "do you want to save this password?" before proceeding. I thought that was silly: how do I know if I want to save the password before I've seen whether it's correct? Which I can't see until the form is submitted. At the time I was using Opera, so I wrote in to their customer suppor…

And now we’ve come full-circle as 1Password 8 requires you to save your password prior to submitting the form instead of offering to save it after submission. Which is a huge regression as it results in this exact issue all over again. https://support.1password.com/save-fill-passwords/

Any person/company/thing that uses 1Password needs to take a look around. Bitwarden is where it is at.

Re: Tell HN: Somebody implemented something I wrote a blog about

#182

Post by ezekg »

weaksauce wrote: post #163
ezekg wrote: post #25

Related: I think it's surprising how many services leak whether or not a password is correct. E.g. bad password => error, good password => 2FA prompt. You should verify a user's second factor before password.

> You should verify a user's second factor before password. the cost of sending those 2fa texts is not zero and also the idea of them is that they are ephemeral so them being tied to the successful entering of username and password and limited in time is a feature... not a bug.

Sure. But I’d argue that nobody should be using SMS 2FA. There are more secure, and cheaper, methods.

Re: Tell HN: Somebody implemented something I wrote a blog about

#183

Post by call-me-al »

I filled in a market research survey for Hetzner they sent me by email. There were many questions on how can we do better, etc. I suggested to use the fact that they are Germans to convey high-quality and attention to details. Months later, I received a promotional email by them in which they were using almost word by word what I had suggested. I guess this one is on me, Hetzner.

Re: Tell HN: Somebody implemented something I wrote a blog about

#184

Post by lots2learn »

WalterBright wrote: post #150
spiffytech wrote: post #28

Years back, every web browser's built-in password manager locked up the page when submitting a login form, waiting for the user to answer "do you want to save this password?" before proceeding. I thought that was silly: how do I know if I want to save the password before I've seen whether it's correct? Which I can't see until the form is submitted. At the time I was using Opera, so I wrote in to their customer suppor…

If only Roku and Android TV boxes had a way to display pdf's on the TV! Hint hint hint!!! After all, they can display movies, pictures, and music. PDFs, please! I'd even pay for it.

You could always open the pdf on your phone and cast your phone screen.

Re: Tell HN: Somebody implemented something I wrote a blog about

#185

Post by mikewarot »

mncharity wrote: post #57

AFAIR, a 1980's MIT AI Lab "how to do research" memo, suggested as one way to build things: describe what you'd like to build, and maybe someone else will be inspired to do it, long before you'd have gotten around to it.

I'm still waiting for the Memex, you would think someone did it between 1945 and now, but nope. 8(

Re: Tell HN: Somebody implemented something I wrote a blog about

#186

Post by O_H_E »

jackpirate wrote: post #151
fimdomeio wrote: post #38

Earlier quoted context omitted.

I found a bug in firefox where the two letters of the weekdays appeared as 3 letters for portuguese (pt-PT). Eventually found that it was an error in the unicode standard, so submited the proposal for change. Probably there's dozen of people involved in this... but seeing it being changed brought me great joy. I was a tiny part in changing a tiny mostly irrelevant detail that was causing a slight inconvenience to mil…

Do you happen to have a link to the proposal I can see and share with a class? I'm teaching a few lectures about some "weird" stuff this semester, and this would be a great example.

Well, that's going to be a very cool class I best !

Re: Tell HN: Somebody implemented something I wrote a blog about

#187

Post by Jemaclus »

jabbany wrote: post #120
ezekg wrote: post #25

Related: I think it's surprising how many services leak whether or not a password is correct. E.g. bad password => error, good password => 2FA prompt. You should verify a user's second factor before password.

This is not a huge deal in practice and can be a good honeypot/alarm system. Most services today have fairly low "lockout" + "notify" thresholds on wrong passwords so brute force spraying passwords is already out of the question. Now, if someone fails the password check, clearly the user's current password is still secure so leaking that the attempted password was wrong to an attacker is not particularly helpful to t…

> Now, if someone fails the password check, clearly the user's current password is still secure so leaking that the attempted password was wrong to an attacker is not particularly helpful to them.

Maybe I misunderstand your post, but I think the parent comment is talking about leaking whether a password is correct and not whether it's wrong. (If I did misread your comment, apologies in advance and disregard the rest.)

The parent comment is basically suggesting that if there are two possibilities for password entry with two different experiences, then we may be telling hackers that passwords are correct, too.

Scenario 1: Password is incorrect and user sees "Oops, wrong password!" message.

Scenario 2: Password is correct and user sees 2FA prompt.

You are correct in that Scenario 1 doesn't help the hacker -- but Scenario 2 does! It tells them that the for username jabbany@email.com, password hunter2 is a valid password. Even if they do hit the 2FA surprise and can't crack it, they can now take jabbany@email.com to any other website and try password hunter2, and any other site using the same credentials that is NOT secured by 2FA is now compromised!

There's also username leakage here. Imagine you had an OnlyFans account, and your coworkers or friends or parents were to put jabbany@email.com into it, and it simply said "Oops, wrong password" instead of something more generic. Now they know you have an OnlyFans account -- which, depending on your relationships, could be problematic, regardless of whether they actually accessed the account.

So to the parent comment's point, it is amazing how often credential leakage happens. And to OOP's point, we should go to 2FA every time, whether the credentials are correct or not. And the error messages should (generally) be more vague than specific, so as not to leak info unintentionally.

Does that make sense? I'm not sure I explained it very well, but I think the parent and I are making a different point than yours -- which is also a valid point, just not what we were talking about.

Re: Tell HN: Somebody implemented something I wrote a blog about

#188

Post by WalterBright »

flatiron wrote: post #176
WalterBright wrote: post #150

Earlier quoted context omitted.

If only Roku and Android TV boxes had a way to display pdf's on the TV! Hint hint hint!!! After all, they can display movies, pictures, and music. PDFs, please! I'd even pay for it.

I understand it not working on a Roku but why couldn’t you use an android pdf reader?

I looked up the android tv box on Amazon. Doesn't support pdfs.

Re: Tell HN: Somebody implemented something I wrote a blog about

#190

Post by rgbrenner »

waynecochran wrote: post #168
frakkingcylons wrote: post #6

Yes! That’s such a nice feeling. One of my GitHub projects was used in a demo at Google Cloud next a while ago. the presenter was considerate enough to attribute the project to me by name during the demo and even sent me an issue just letting me know about it. That was so nice! Absolutely people should do this.

I actually had someone take one of my personal iOS apps from GitHub ( https://github.com/wcochran/calfoo ) and submit it to the app store as if it was theirs. Someone else told me -- I was gobsmacked that someone was so brazen. Oh well, I didn't license it. It had special features that only mattered to me (and would be inappropriate for general use).

Just fyi, if something is unlicensed, then other people can only use it under fair use. You’re the copyright holder automatically upon publishing and retain all rights. If you intend to let people do anything, then you need to explicitly put it in the public domain or use an appropriate license.

It’s very unlikely they can legally do what you’re describing… but it’s up to you to enforce it.

Post reply on HN