Live data from Hacker News

Substack's UI and 1Password temporarily cost me $2k

timmyomahony.com

191–200 of 278 posts

Re: Substack's UI and 1Password temporarily cost me $2k

#191

Earlier quoted context omitted.

I remember using a company-mandated pension website which required a very long password with a comprehensive selection of complexity requirements. To log in, the password had to be entered twice, but they had disabled the ability to use a password manager to populate them (I forget the exact mechanism). To me this is the worst of all worlds. If you put people off using your website, you are less likely to have breach…

My broker asks for 4-5 random letters of my password each time, making password managers unusable as well. Thinking about it now, how would you encrypt a password using this method? Create hashes of every combination?

Nit: I think you mean hashing, not encryption.

Though, my bank uses a dual-password setup where the first password is required in its entirety and a few letters of the second password are required. I suspect this is stored by using a (hopefully memory-hard) salted key derivation function/password hash function (such as Argon2 or scrypt) to derive an encryption key from the first password, which is then used to decrypt the second password.

At least, that's the way I'd design the system to minimize consequences of database compromise. Users are often not creative and often use related passwords. You'd want all of the stored information about the second password to provide clues to the first password only if the attacker had already cracked the first password. Hashing all of the permutations really blows up storage space and DB I/O.

Re: Substack's UI and 1Password temporarily cost me $2k

#192
The abominable UX in this situation is that users need to give free access to their credit card for payment, at the promise that the other party will play nice. This is backed by strong laws, but still absurd.

The control should be inversed: the 3rd party should request payment from your bank and you would be able to confirm it from the bank website or app.

This is already possible in Portugal with an app where you can give a seller your phone number and it prompts you for payment.

(might be something of a privacy issue, but it beats a possible fraud issue)

Re: Substack's UI and 1Password temporarily cost me $2k

#193
post #192

The abominable UX in this situation is that users need to give free access to their credit card for payment, at the promise that the other party will play nice. This is backed by strong laws, but still absurd. The control should be inversed: the 3rd party should request payment from your bank and you would be able to confirm it from the bank website or app. This is already possible in Portugal with an app where you c…

Poland has a neat system - you input one time code into the sellers payment processor, and then you get to confirm the payment in your app.

Code is one time use, valid for 2 minutes - and you can see all the details in the confirmation that comes from your banking app.

you can also use the same system to tie your phone number to your bank acc, letting other people in this system send you money instantly without extra fees between different banks - and you only need to share your phone number.

Re: Substack's UI and 1Password temporarily cost me $2k

#194
post #116

Earlier quoted context omitted.

Ths is an appeal to authority. It is a shortcoming of the product's design for it to autofill a hidden field.

It is a visible input field styled not to look like an input field until that radio button is selected, but it is not "hidden" in the HTML sense. It is not a shortcoming of the product's design to not have parsed the CSS and intuited that Substack's designers wanted to cleverly make it not look like an input field.

> It is not a shortcoming of the product's design to not have parsed the CSS and intuited that Substack's designers wanted to cleverly make it not look like an input field.

How is it not a shortcoming? Any human looking at the page can immediately tell that this form field should not be autofilled.

Difficult problem to solve? Sure, doesn't make it any less of a shortcoming.

Re: Substack's UI and 1Password temporarily cost me $2k

#195
post #124
post #116

Earlier quoted context omitted.

Ths is an appeal to authority. It is a shortcoming of the product's design for it to autofill a hidden field.

It’s visually hidden for us to see, not for 1Password auto fill mechanism.

Which is a problem in the 1Password autofill mechanism. Unless you believe that it should be filling forms which are hidden from humans?

Re: Substack's UI and 1Password temporarily cost me $2k

#196

I've updated my blog post to include 1Password in the title as it contributed to the issue (I can't update the title here). That said, I've never experienced this before, having used 1Password on 100s of other payment forms so something is up. I do think there are design issues with people being able to set subscription amounts manually without having a confirmation step when doing so.

1password payment form filling works fine so rarely for me, I usually copy just number by hand. I wonder if that's somehow specific to Russia (field names are still in english, but it doesn't seem to help much)

Re: Substack's UI and 1Password temporarily cost me $2k

#197

Earlier quoted context omitted.

My broker asks for 4-5 random letters of my password each time, making password managers unusable as well. Thinking about it now, how would you encrypt a password using this method? Create hashes of every combination?

Possibly using this? https://en.wikipedia.org/wiki/Shamir%27s_Secret_Sharing I think a lot of implementations don't do anything clever and just have a fixed set of combinations they use each time, so the number of stored hashes is smaller.

I thought about something similar to Shamir's Secret Sharing, polynomial fitting over a finite field, but in this case, information theory is working against you.

With Shamir's Secret Sharing, you start out with your secret expressed as a finite field element, and pick N-1 polynomial coefficients uniformly randomly from your finite field, and give M different participants values of the polynomial evaluated at different points. Information theory shows that having at most N-1 points on the polynomial still leaks no information about F(0). It's as secure as a one-time pad, and in the degenerate case of N=2 over a Galois field, is in fact a XOR-based one-time-pad. The amount of entropy added at generation time is greater than the amount of entropy in the secret.

In this partial password case, you'd want the "shared secret" to be a single value, and construct a polynomial such that, say 4 field elements, would always be sufficient to recover the same "secret". You're running the algorithm the wrong way, and unless you're forcing a password on the person, those letters are actually low-entropy instead of maximal entropy field points as in Shamir Secret Sharing.

I really don't see a way to use polynomial interpolation in this way without leaking entropy. I thought about using something similar to Schnorr threshold signatures[0] to solve the information leakage, but then you end up storing one elliptic curve public key per password letter, and the private key for each public key is a single letter, so trivial to bruit-force.

[0] https://eprint.iacr.org/2020/852.pdf

Re: Substack's UI and 1Password temporarily cost me $2k

#198
post #192

The abominable UX in this situation is that users need to give free access to their credit card for payment, at the promise that the other party will play nice. This is backed by strong laws, but still absurd. The control should be inversed: the 3rd party should request payment from your bank and you would be able to confirm it from the bank website or app. This is already possible in Portugal with an app where you c…

Some countries have their own variations of this but they all feel half-assed to me and often rely on phone numbers or something equally stupid.

We already have an industry standard for access delegation: OAuth, which has been battle-tested over 10 years and supports different flows for various applications (browser, mobile app, etc).

Re: Substack's UI and 1Password temporarily cost me $2k

#199
post #159

This is an example of a common antipattern in software: some piece of software fails to correctly implement something (here, modern HTML autocomplete="cc-exp-year"), and another piece of software goes through all kinds of contortions to work with incorrect or incomplete implementations with the result that it now behaves undesirably with a third piece of software. Specifically, 1Password has to do complicated guesses…

I have little faith site developers care about password managers. Many even try to block them from working due to some perceived notion that they are insecure.

What, is "password managers are insecure" really a thing?

Re: Substack's UI and 1Password temporarily cost me $2k

#200

This is an example of a common antipattern in software: some piece of software fails to correctly implement something (here, modern HTML autocomplete="cc-exp-year"), and another piece of software goes through all kinds of contortions to work with incorrect or incomplete implementations with the result that it now behaves undesirably with a third piece of software. Specifically, 1Password has to do complicated guesses…

> I can't offer a general solution, but if password managers simply refused to autofill to any field other than the one with the matching standard autocomplete attribute, web developers might start doing the right thing. Unlikely. The password managers would just lose users. I've even caught myself being annoyed at 1Password when it doesn't work while the cause is obviously the website doing some stupid thing. I wond…

Some password manager allow you to config those parameters yourself but I guess that would not work in this case.

Hopefully hardware tokens can help us get rid of passwords soon.

Post reply on HN