Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Safari tries to fill username

github.com

Post reply on HN
Print view View original

191–200 of 393 posts

Re: Safari tries to fill username

#191

Post by hallway_monitor »

Retric wrote: post #159
Cthulhu_ wrote: post #131

Earlier quoted context omitted.

After 15 minutes, or 15 minutes of inactivity? The latter is defensible at least, in e.g. a public area where there is a risk of people leaving their desktops without locking them. I mean that's another policy issue that can be addressed (a policy that locks a system after x amount of inactivity), but as an app developer you can't know much about the system things are running on.

Careful. Filling out a long form isn’t 15 minutes of inactivity, but a huge range of websites assume it is.

PTSD causes me to copy and paste big blocks of text out of a text area before submitting every time.

Re: Safari tries to fill username

#192

Post by rashil2000 »

rimliu wrote: post #64
rashil2000 wrote: post #17

Earlier quoted context omitted.

No, but Safari routinely causes many problems that seem utterly basic for Firefox/Chrome.

Because you develop on Chrome, and only occasionally test on Safari. Try the other way around and see which one is buggy.

Why does this matter so much? Our team purposefully decided to use a really well known component library (Material UI React) so that it automatically takes care of browser inconsistencies. But no, I still find myself and my team scratching our heads writing a ton of Safari-specific CSS just to ensure it works on par with Firefox.

Re: Safari tries to fill username

#193

Post by okamiueru »

rd11235 wrote: post #82
samjmck wrote: post #60

It _wants_ to autofill, but it doesn't without the user actually confirming the autofill. Pretty important distinction to make I think

Agree. Current title is inaccurate and click baity. Also, the confirmation requires authentication (at least by default, unsure if this can be changed).

In case it changes, for context, the current title is

> The phrase “welcome back” on a page causes Safari to autofill a password

Re: Safari tries to fill username

#194

Post by vincnetas »

Cederfjard wrote: post #57
vincnetas wrote: post #33

Earlier quoted context omitted.

It's not up to Chrome devs to accept or deny viable use cases. As someone from comments mentions, it's in the spec, and chrome devs should not deviate from that irrelevant if what they think is accepted or not accepted use case. Or they should go and push for spec change.

The spec is driven by browser implementations rather than the other way around, is it not?

It should not be so. Or else Spec would just look like "do as chrome does"

Re: Safari tries to fill username

#195

Post by hedora »

PebblesRox wrote: post #147
izacus wrote: post #62

Earlier quoted context omitted.

Oh man, enterprise "security" firms used by banks and other old behemoths are a cancer for users. If you want your website to actively abuse users (especially one with special needs and pretty much anyone that doesn't fit into an "made up average person mold") get those people on board and listen to the dumb things they say. I still can't believe that whole business managed to interpret 2FA for whole EU as "you MUST…

I use Coface for work to check credit for potential customers. Instead of a password, they require a 6-digit pin. It can't be auto-filled or entered with the keyboard. There's an on-screen number pad that you have to click on and the numbers are scrambled - they show up in a different arrangement every time. Such a pain!

You could probably outsource the pin entry to a human or AI based third party service.

Re: Safari tries to fill username

#196

Post by _jal »

sneak wrote: post #182
dkdbejwi383 wrote: post #120

Earlier quoted context omitted.

The product I work on now logs users out after 15 minutes. It's a service where the average user would probably spend a good few hours of their day. We're actively harming the user experience (and driving paying customers away) because of some "expert" advice.

The problem with the security industry is that there's no way for non-experts to reliably assess "I'm an expert, trust me!" from a practitioner. I'm not really sure what the best fix is; there are many possible ones. I've seen total clowns pushing decades-old nonsense be taken seriously by competent businesses simply because they thought "hiring an expert" was enough, like they're a plumber or something.

It is no different than doctors or mechanics or lawyers. Reputation is your best guide. In security-land, there are some certifications that are fairly rigorous; some of those can serve as a distant second.

Re: Safari tries to fill username

#197

Post by dhimes »

airza wrote: post #43
WayToDoor wrote: post #7

Related, there is a "bug" in chrome that disabled autocomplete="off" on input elements, marked as won't fix https://bugs.chromium.org/p/chromium/issues/detail?id=587466

The nuance here is that brain-damaged appsec pentesters reported this as a vulnerability for years, and so tons of websites followed that advice and dutifully disabled the functionality. But autocomplete has advantages: it lets users easily specify long, random, per-site passwords without ever having to worry about that. And when they can't do that, a pretty large percentage of them just give up and write the passwor…

Maybe it's just me but I can't trust Chrome with my passwords anyway. It seems like every update they wipe out the store. So I only use Chrome for GSuite (or whatever they call it now). And, of course, I have to use a pw I can remember.

My biggest security vuln is Google. And I've seen too many new account usernames out there like forgotlastpasspw to use an external manager.

Firefox, thankfully, keeps the passwords.

Re: Safari tries to fill username

#198

Post by vincnetas »

thaumasiotes wrote: post #75
vincnetas wrote: post #33

Earlier quoted context omitted.

It's not up to Chrome devs to accept or deny viable use cases. As someone from comments mentions, it's in the spec, and chrome devs should not deviate from that irrelevant if what they think is accepted or not accepted use case. Or they should go and push for spec change.

I feel like repeating an old comment of mine ( https://news.ycombinator.com/item?id=27231194 ) here: > Conforming to the spec is not a virtue. > When the spec is malicious, conforming to the spec is malicious behavior. > I'm comfortable calling it a bug in the spec. `a > This behavior is documented , but that doesn't make things better, it makes them worse. > But the philosophy that says "if it's documented, then it'…

I think predictability is important. And specs define what you can expect. System with undefined/unpredictable behaviour does complicate a life in long run even if at the moment it looks more convenient.

Re: Safari tries to fill username

#199

Post by jefftk »

jpttsn wrote: post #68
thomasfortes wrote: post #48

Earlier quoted context omitted.

Both are the new IE, one push features without caring about the rest of the ecosystem and the other refuses to implement standards without caring about the rest of the ecosystem. The end result is that the web right now has stuff that works only on Chrome and stuff that works everywhere besides Safari. And the fact that iOS users can't change their browser forces developers that want their projects to reach the maxim…

Honest question: Do we have any scroll vs. marquee type situations today? Because (Unpopular): I believe the standard should primarily cover how the overlapping functionality works, and refrain from limiting or prescribing the extent of functionality. Comparing: If I build a HTTP API, I don’t have to support the DELETE verb for any endpoints. I can support ENCHANT if I want magic that other servers don’t have. But if…

> Because (Unpopular): I believe the standard should primarily cover how the overlapping functionality works, and refrain from limiting or prescribing the extent of functionality ... the standard body has just overplayed it’s hand.

But that is how web standards work already? Vendors are not prohibited from adding additional functionality.

Re: Safari tries to fill username

#200

Post by everydaypanos »

Imagine how much code like this is inside our "lightweight" browsers.

All the code reviews that passed this on to production make you wonder how competent these browser makers actually are..

I think that the browser should not treat every input field as a personal info form for the current user. There are plenty of cases of web apps I can think of where disabling autocomplete is best user experience overall.

Post reply on HN