Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Substack's UI and 1Password temporarily cost me $2k

timmyomahony.com

Post reply on HN
Print view View original

211–220 of 278 posts

Re: Substack's UI and 1Password temporarily cost me $2k

#211

Post by Nextgrid »

filleduchaos wrote: post #205
Nextgrid wrote: post #198

Earlier quoted context omitted.

Some countries have their own variations of this but they all feel half-assed to me and often rely on phone numbers or something equally stupid. We already have an industry standard for access delegation: OAuth, which has been battle-tested over 10 years and supports different flows for various applications (browser, mobile app, etc).

3-D Secure was introduced in 2001. Additionally, I don't quite think making a payment is within the problem domain of OAuth. Most often I'm explicitly not trying to give the site access to my account - I'm trying to fulfil one request.

> I don't quite think making a payment is within the problem domain of OAuth

OAuth is merely a way to authorize access. Depending on which scopes are requested, it could be a one-off request. Typically in webapps, access is assumed to be a one-off unless the "offline_access" scope is requested for example.

Furthermore OAuth would improve recurring payments - the website can request a max payment amount or frequency and the user (on their bank's authentication page) can further constrain those settings if needed.

Re: Substack's UI and 1Password temporarily cost me $2k

#212

Post by yoz-y »

benhurmarcel wrote: post #208
yoz-y wrote: post #204

Earlier quoted context omitted.

Yes, if not explicitly then by their actions definitely. E.g.: there is only a single bank in France that hasn't switched to a stupid 6-8 digit system where you have to click buttons that appear in random order. Before then they often disabled autofill on passwords (luckily that could have been easily bypassed). They incessantly re-invent the wheel for 2-factor auth and so on. I find it very curious why banks of all…

Not sure if that's the bank you're talking about, but FYI Fortuneo lets you use a normal password.

Yep, Fortuneo is the one still having sane security. There might be others but when I was bank-shopping I haven't found one.

Re: Substack's UI and 1Password temporarily cost me $2k

#213

Post by benhurmarcel »

oefrha wrote: post #18
CGamesPlay wrote: post #5

Earlier quoted context omitted.

Yeah it seems pretty clear that this was a 1Password flaw and didn't really have anything to do with Substack's UI. And yes, the first paragraph notes that no money was spent, so not really sure why multiple people have downvoted your comment.

If your UI can charge me $2023 instead of $250 without so much of a confirmation, your UI is just a minefield. Forget about auto fill, humans make typos in a free entry text box.

In Germany, when paying at a restaurant, the machine often asks you to type the tip you want, before your card PIN. The (badly lit) screen also tells that to the user in German, which doesn't help if you don't speak it.

It has happened quite often that I typed my PIN by habit and the machine just refused a tip amount that large, thankfully.

Re: Substack's UI and 1Password temporarily cost me $2k

#214

Post by benhurmarcel »

rawoke083600 wrote: post #182

Honest Question: Why do you guys use PW and not just Chrome build-in pw ? Assuming you neutral or not anti-google in the first place.

You can store any number of fields, rather than just 1 username and password per website.

I typically have notes, maybe one-time passwords, a PIN, the email I signed up with, whether they have my address, various URL if they share the login, etc.

Re: Substack's UI and 1Password temporarily cost me $2k

#215

Post by benhurmarcel »

yoz-y wrote: post #212
benhurmarcel wrote: post #208

Earlier quoted context omitted.

Not sure if that's the bank you're talking about, but FYI Fortuneo lets you use a normal password.

Yep, Fortuneo is the one still having sane security. There might be others but when I was bank-shopping I haven't found one.

Sane security would be using a one-time password 2FA in my opinion, but yes, it's the only one I know with a non-crazy login method.

Re: Substack's UI and 1Password temporarily cost me $2k

#216

Post by tinus_hn »

KMag wrote: post #191
EveYoung wrote: post #180

Earlier quoted context omitted.

My broker asks for 4-5 random letters of my password each time, making password managers unusable as well. Thinking about it now, how would you encrypt a password using this method? Create hashes of every combination?

Nit: I think you mean hashing, not encryption. Though, my bank uses a dual-password setup where the first password is required in its entirety and a few letters of the second password are required. I suspect this is stored by using a (hopefully memory-hard) salted key derivation function/password hash function (such as Argon2 or scrypt) to derive an encryption key from the first password, which is then used to decryp…

Hashing in this sense is one way encryption.

Re: Substack's UI and 1Password temporarily cost me $2k

#217

Post by tinus_hn »

mPReDiToR wrote: post #175
tweetle_beetle wrote: post #174

Earlier quoted context omitted.

I remember using a company-mandated pension website which required a very long password with a comprehensive selection of complexity requirements. To log in, the password had to be entered twice, but they had disabled the ability to use a password manager to populate them (I forget the exact mechanism). To me this is the worst of all worlds. If you put people off using your website, you are less likely to have breach…

I recently got an OnlyKey. It plugs in as an HID so that passwords appear to have been typed in, not PW managed. Useful little thing, it seems too good to be true.

This means the password manager can’t check it isn’t entering your credentials on app1e.com

Re: Substack's UI and 1Password temporarily cost me $2k

#218

Post by egoisticalgoat »

It's been a while, but a similar thing happened to me. The delivery address form was on the same page as the cart, and my autofill put my zip code into the article amount. A little shocking at first to see a bill of 65,000€ instead of 12€, but at least it took less than an hour to resolve.

Re: Substack's UI and 1Password temporarily cost me $2k

#219

Post by tinus_hn »

yoz-y wrote: post #204
metafunctor wrote: post #199

Earlier quoted context omitted.

What, is "password managers are insecure" really a thing?

Yes, if not explicitly then by their actions definitely. E.g.: there is only a single bank in France that hasn't switched to a stupid 6-8 digit system where you have to click buttons that appear in random order. Before then they often disabled autofill on passwords (luckily that could have been easily bypassed). They incessantly re-invent the wheel for 2-factor auth and so on. I find it very curious why banks of all…

Hardly surprising considering how long they clung to ‘secret questions’.

Re: Substack's UI and 1Password temporarily cost me $2k

#220

Post by monkin »

FDSGSG wrote: post #195
monkin wrote: post #124

Earlier quoted context omitted.

It’s visually hidden for us to see, not for 1Password auto fill mechanism.

Which is a problem in the 1Password autofill mechanism. Unless you believe that it should be filling forms which are hidden from humans?

So you want 1Password to check CSS of the form before auto filling? The form itself isn’t hidden it’s styled to be flat. That’s the biggest problem of it.
Post reply on HN