Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Safari tries to fill username

github.com

Post reply on HN
Print view View original

211–220 of 393 posts

Re: Safari tries to fill username

#211

Post by jwr »

oblvious-earth wrote: post #203
airza wrote: post #43

Earlier quoted context omitted.

The nuance here is that brain-damaged appsec pentesters reported this as a vulnerability for years, and so tons of websites followed that advice and dutifully disabled the functionality. But autocomplete has advantages: it lets users easily specify long, random, per-site passwords without ever having to worry about that. And when they can't do that, a pretty large percentage of them just give up and write the passwor…

I used to support a client facing app at a bank and the appsec pentesters were a joke: * Username and Password fields must not autocomplete * Username and Password fields must not allow text to be pasted in to the field * Password must be at least 8 characters with lower case, upper case, numbers, and special characters (they didn't care it had a maximum length of 8 characters) I straight up told our project manageme…

In these cases, it makes sense to point people to NIST Special Publication 800-63B (Digital Identity Guidelines) https://pages.nist.gov/800-63-3/sp800-63b.html — their guidelines are pretty good and eliminate much of the braindead nonsense that is considered "accepted practice in the industry".

Re: Safari tries to fill username

#212

Post by hedora »

im3w1l wrote: post #109
thaumasiotes wrote: post #80

Earlier quoted context omitted.

Yes, that shared key is a password, a piece of knowledge known in common between you and them.

The key thing is that an attacker wont be able to keylog the shared secret, or trick me into typing it on the wrong site.

They will be able to trick you into typing it on the wrong site (more likely, wrong terminal) if they’ve compromised your machine. They just need to wait for you to log in.

Similarly, they can grab the shared secret from the server.

It’s marginally better than a password manager (though some of those support TOTP now), since they can’t pull all your credentials by keylogging your master password.

Re: Safari tries to fill username

#213

Post by schnable »

realusername wrote: post #45
eitland wrote: post #35

Earlier quoted context omitted.

No. This is a small but important detail: Chrome is the new IE. IE wasn't mainly a problem because it didn't support things, rather because it was - in the beginning - superior, but also had all sorts of non standard behaviour that Microsoft pushed and that made competition crazy hard. Oh, and also because they pushed it relentlessly in all ways including - as was later confirmed in court - illegal ways. Exactly like…

> No. This is a small but important detail: Chrome is the new IE. In terms of market share and market power yes it's comparable, in term of tech issues, not really no, it's not even close. Chrome has a very good rendering engine, there's a few quirks here and there, I might have encountered some strange logic once or twice but that's about it. Safari on the other hand is really comparable in terms of tech issues and…

I dunno, Safari uses a ton less memory and CPU on my MacBook Pro.

Re: Safari tries to fill username

#214

Post by lmilcin »

airza wrote: post #119
lmilcin wrote: post #76

Earlier quoted context omitted.

Autocomplete has one huge, glaring disadvantage: the passwords are stored on your computer, in reversible form.

Not really a glaring disadvantage. If someone has physical access to your unlocked computer and wants to do bad stuff to you, you are going to have a very bad day.

Consider Chrome, automatically, by default, replicates all your passwords to all your devices on which you are signed in.

Thankyouverymuch. I am gonna keep using my password book.

There is no sure way, as a private person and not being expert in security, to secure your browser. But there are ways to limit the damage that can be made. Maybe just don't make it too convenient and have a database of all your passwords on all your devices?

Re: Safari tries to fill username

#215

Post by abcxjeb284 »

dkdbejwi383 wrote: post #120
izacus wrote: post #62

Earlier quoted context omitted.

Oh man, enterprise "security" firms used by banks and other old behemoths are a cancer for users. If you want your website to actively abuse users (especially one with special needs and pretty much anyone that doesn't fit into an "made up average person mold") get those people on board and listen to the dumb things they say. I still can't believe that whole business managed to interpret 2FA for whole EU as "you MUST…

The product I work on now logs users out after 15 minutes. It's a service where the average user would probably spend a good few hours of their day. We're actively harming the user experience (and driving paying customers away) because of some "expert" advice.

This one is based in security standards :( https://security.stackexchange.com/questions/45455/which-sec... (link talks about screen locking but similar vibe for app logout for various certification bodies)

Re: Safari tries to fill username

#216

Post by hedora »

thaumasiotes wrote: post #83
nl wrote: post #79

Earlier quoted context omitted.

TOTP is a second factor. The hash seed that generates a password is connected to the device.

The seed is all you need. The device is unnecessary.

So, it’s a password.

All I need for password authentication is the password and a device that can generate a one time proof that I know the password.

TOTP just seems more secure because the password is never displayed to the end-user.

Re: Safari tries to fill username

#218

Post by maybevain »

pachico wrote: post #172

I'm wondering if in other languages it would happen too. I don't have safari so I can't try it out but, what if you wrote "bentornato"? Would it also trigger it?

I tested it with the ”Welcome back” equivalent in Finnish, German, French and Chinese. None of those languages caused the autofill interface to show up.

Safari is in Finnish on my phone, and I used the phrase ”Tervetuloa takaisin” to test. For the other languages I used whatever Google Translate suggested.

Re: Safari tries to fill username

#219

Post by wildrhythms »

vincnetas wrote: post #198
thaumasiotes wrote: post #75

Earlier quoted context omitted.

I feel like repeating an old comment of mine ( https://news.ycombinator.com/item?id=27231194 ) here: > Conforming to the spec is not a virtue. > When the spec is malicious, conforming to the spec is malicious behavior. > I'm comfortable calling it a bug in the spec. `a > This behavior is documented , but that doesn't make things better, it makes them worse. > But the philosophy that says "if it's documented, then it'…

I think predictability is important. And specs define what you can expect. System with undefined/unpredictable behaviour does complicate a life in long run even if at the moment it looks more convenient.

If the topic is predictability, I would expect banks to use the spec to disable only predictably non-autofillable fields with the user's best experience in mind. Disabling autocomplete on username and password fields in the name of some nebulous 'security' goal is neither predictable, nor in line with most user's expectation of usability; it also doesn't make the system more secure. I could argue that these sites themselves aren't following the spec by disabling the fields.

Remember, there are autocomplete values to accommodate "current-password"[1]. If your bank has a field representing a password without that attribute, do you think that's following the spec?

[1] https://html.spec.whatwg.org/multipage/form-control-infrastr...

Post reply on HN