Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Safari tries to fill username

github.com

Post reply on HN
Print view View original

201–210 of 393 posts

Re: Safari tries to fill username

#201

Post by dvtrn »

_jal wrote: post #196
sneak wrote: post #182

Earlier quoted context omitted.

The problem with the security industry is that there's no way for non-experts to reliably assess "I'm an expert, trust me!" from a practitioner. I'm not really sure what the best fix is; there are many possible ones. I've seen total clowns pushing decades-old nonsense be taken seriously by competent businesses simply because they thought "hiring an expert" was enough, like they're a plumber or something.

It is no different than doctors or mechanics or lawyers. Reputation is your best guide. In security-land, there are some certifications that are fairly rigorous; some of those can serve as a distant second.

Doctors and lawyers are professions that are regulated by licensure, of which unauthorized practice comes with actual real and not made up legal consequences. Where is the similar licensure that tech security professionals are regulated by?

I think that’s a big difference.

Re: Safari tries to fill username

#202

Post by hedora »

lucideer wrote: post #86
thaumasiotes wrote: post #70

Earlier quoted context omitted.

> I still can't believe that whole business managed to interpret 2FA for whole EU as "you MUST use SMS for 2FA!". Weeeeeelll... I'm familiar with two (2) common kinds of "2FA" implementations. TOTP and SMS. Of those two, only SMS is actually a second factor, albeit not a particularly secure one. TOTP is fundamentally a password, and two passwords are no different than one password.

> TOTP is fundamentally a password I see this view a lot. It's wrong. TOTP is fundamentally different to a password, as the stored "password" (by which I presume you mean the key) is never transmitted anywhere. TOTP in fact has one property that makes it potentially* the most secure of all 2FA methods: it can be used airgapped. As the credential you type into the 2FA form is not the saved secret. * I say "potentially…

Digest authentication allows passwords to be authenticated without sending the “key”, and could also be used airgapped.

You’d need to type a nonce into the dongle, then type the result into your computer.

TOTP is just a password. Also, in practice, the server has to have non-air-gappped access to a TOTP generator, so it’s not really air gapped at all.

Read up on the great RSA key fob recall for an example of TOTP-style auth gone horribly wrong.

Re: Safari tries to fill username

#203

Post by oblvious-earth »

airza wrote: post #43
WayToDoor wrote: post #7

Related, there is a "bug" in chrome that disabled autocomplete="off" on input elements, marked as won't fix https://bugs.chromium.org/p/chromium/issues/detail?id=587466

The nuance here is that brain-damaged appsec pentesters reported this as a vulnerability for years, and so tons of websites followed that advice and dutifully disabled the functionality. But autocomplete has advantages: it lets users easily specify long, random, per-site passwords without ever having to worry about that. And when they can't do that, a pretty large percentage of them just give up and write the passwor…

I used to support a client facing app at a bank and the appsec pentesters were a joke:

* Username and Password fields must not autocomplete * Username and Password fields must not allow text to be pasted in to the field * Password must be at least 8 characters with lower case, upper case, numbers, and special characters (they didn't care it had a maximum length of 8 characters)

I straight up told our project management it was actively hurting our security, and was told the the point here was to fulfill a regulatory requirement to complete and resolve all issues from a independent "pentest" not to improve security.

Re: Safari tries to fill username

#204

Post by colejohnson66 »

hedora wrote: post #195
PebblesRox wrote: post #147

Earlier quoted context omitted.

I use Coface for work to check credit for potential customers. Instead of a password, they require a 6-digit pin. It can't be auto-filled or entered with the keyboard. There's an on-screen number pad that you have to click on and the numbers are scrambled - they show up in a different arrangement every time. Such a pain!

You could probably outsource the pin entry to a human or AI based third party service.

Such as Amazon’s Mechanical Turk?

Re: Safari tries to fill username

#205

Post by _jal »

PebblesRox wrote: post #147
izacus wrote: post #62

Earlier quoted context omitted.

Oh man, enterprise "security" firms used by banks and other old behemoths are a cancer for users. If you want your website to actively abuse users (especially one with special needs and pretty much anyone that doesn't fit into an "made up average person mold") get those people on board and listen to the dumb things they say. I still can't believe that whole business managed to interpret 2FA for whole EU as "you MUST…

I use Coface for work to check credit for potential customers. Instead of a password, they require a 6-digit pin. It can't be auto-filled or entered with the keyboard. There's an on-screen number pad that you have to click on and the numbers are scrambled - they show up in a different arrangement every time. Such a pain!

I think this is the manifestation of non-logical associations humans make.

When I was a kid, a teacher told me learning was supposed to be hard and unpleasant, and I believed her for a long time. Only when I started enjoying myself in spite of that did I see it was wrong, and I started doing well in school, and (more importantly) pursuing my own interests.

There's a similar thing with security - people assume good security must be painful, so making it painful becomes a goal. Sometimes this is sincere, sometimes (TSA) intentional theater. But either way, the result is intentional hostility to the people who use the system.

I'd bet money they have a one-sentence answer for why it does each of those things ("order is scrambled to prevent shoulder-surfing"), but have done zero testing to determine whether those theories are correct.

Re: Safari tries to fill username

#206

Post by _jal »

dvtrn wrote: post #201
_jal wrote: post #196

Earlier quoted context omitted.

It is no different than doctors or mechanics or lawyers. Reputation is your best guide. In security-land, there are some certifications that are fairly rigorous; some of those can serve as a distant second.

Doctors and lawyers are professions that are regulated by licensure, of which unauthorized practice comes with actual real and not made up legal consequences. Where is the similar licensure that tech security professionals are regulated by? I think that’s a big difference.

It is normal to get a little confused when you ignore half the comment.

Re: Safari tries to fill username

#207

Post by dvtrn »

_jal wrote: post #206
dvtrn wrote: post #201

Earlier quoted context omitted.

Doctors and lawyers are professions that are regulated by licensure, of which unauthorized practice comes with actual real and not made up legal consequences. Where is the similar licensure that tech security professionals are regulated by? I think that’s a big difference.

It is normal to get a little confused when you ignore half the comment.

Are you unironically comparing a certification in technology to a license to practice medicine or law?

Re: Safari tries to fill username

#208

Post by shp0ngle »

oblvious-earth wrote: post #203
airza wrote: post #43

Earlier quoted context omitted.

The nuance here is that brain-damaged appsec pentesters reported this as a vulnerability for years, and so tons of websites followed that advice and dutifully disabled the functionality. But autocomplete has advantages: it lets users easily specify long, random, per-site passwords without ever having to worry about that. And when they can't do that, a pretty large percentage of them just give up and write the passwor…

I used to support a client facing app at a bank and the appsec pentesters were a joke: * Username and Password fields must not autocomplete * Username and Password fields must not allow text to be pasted in to the field * Password must be at least 8 characters with lower case, upper case, numbers, and special characters (they didn't care it had a maximum length of 8 characters) I straight up told our project manageme…

Ahhhh, so that's why banks specifically often don't allow automatic filling/pasting.

It's because it's in some dumb regulatory pentest manual or something. OK.

Re: Safari tries to fill username

#209

Post by schnable »

himinlomax wrote: post #146
airza wrote: post #43

Earlier quoted context omitted.

The nuance here is that brain-damaged appsec pentesters reported this as a vulnerability for years, and so tons of websites followed that advice and dutifully disabled the functionality. But autocomplete has advantages: it lets users easily specify long, random, per-site passwords without ever having to worry about that. And when they can't do that, a pretty large percentage of them just give up and write the passwor…

I don't even know if it was security consultants who ever recommended that. It's the same thing with disabling pasting into password fields. A lot of websites used to do that, many probably still do, but I have never seen a security team, no matter how braindead, recommend that nonsense. Rather, it's well-intentioned but stupid project managers following industry worst practices. You can't get in trouble for doing wh…

Ditto for credit card number entries. I use Dashlane to copy my CC info out of, and if that doesn't work, there is a good chance I'm not buying on your site. Maddening and pointless.

I agree this is probably product managers, but may also be engineers who have strongly held "security" opinions and nobody to check them.

Re: Safari tries to fill username

#210

Post by ta988 »

hallway_monitor wrote: post #191
Retric wrote: post #159

Earlier quoted context omitted.

Careful. Filling out a long form isn’t 15 minutes of inactivity, but a huge range of websites assume it is.

PTSD causes me to copy and paste big blocks of text out of a text area before submitting every time.

sounds like what an extension could do. store in localstorage the last hour of forms. I especially hate clicking submit to get an error and an empty form again.
Post reply on HN