Safari tries to fill username • Hacker News Board

Re: Safari tries to fill username

#221

Post by maybevain » Fri, May 28, 2021, 1:27 PM UTC

gvx wrote: post #138

niek_pas wrote: post #55

Earlier quoted context omitted.

Just tested it in Dutch ("Welkom terug"), which does not trigger the autocomplete.

Is the Safari UI in Dutch for you? (I never set UI language to Dutch if I can avoid it even though it's my native language, the localization is often so clunky that I find it distracting)

I tested it with my native language (both the text on the website and the browser UI). The autofill interface did not show up.

Then again Finnish has anyway been a second class citizen when it comes to iOS features.

Re: Safari tries to fill username

#222

Post by wildrhythms » Fri, May 28, 2021, 1:28 PM UTC

HatchedLake721 wrote: post #170

1337shadow wrote: post #23

Earlier quoted context omitted.

As a webdev I can confirm that I have exactly the same experience supporting Safari that I had supporting IE 15 years ago.

Can you share details?

Everyone loves CSS grid layout now, right?

On Safari (both iOS and OS X) Safari does not support grid-gap, i.e. "gap" CSS property.

https://developer.mozilla.org/en-US/docs/Web/CSS/gap#support...

I use the fullscreen API to give prototype demos of a product to clients, and iOS [iPhone] Safari doesn't support the fullscreen API.

https://developer.mozilla.org/en-US/docs/Web/API/Fullscreen_...

Re: Safari tries to fill username

#223

Post by nevi-me » Fri, May 28, 2021, 1:28 PM UTC

airza wrote: post #43

WayToDoor wrote: post #7

Related, there is a "bug" in chrome that disabled autocomplete="off" on input elements, marked as won't fix https://bugs.chromium.org/p/chromium/issues/detail?id=587466

The nuance here is that brain-damaged appsec pentesters reported this as a vulnerability for years, and so tons of websites followed that advice and dutifully disabled the functionality. But autocomplete has advantages: it lets users easily specify long, random, per-site passwords without ever having to worry about that. And when they can't do that, a pretty large percentage of them just give up and write the passwor…

This stuff matters, and I hadn't thought of it in the way you're putting it.

One of our local banks disabled autofill without warning, and they went out of their way to detect if someone was pasting a password.

There was backlash and frustration, and they eventually reversed the decision.

After reversing it, they still put a disclaimer about not pasting passwords, but that disappeared after a few weeks.

Re: Safari tries to fill username

#224

Post by SigmundA » Fri, May 28, 2021, 1:32 PM UTC

WayToDoor wrote: post #7

Related, there is a "bug" in chrome that disabled autocomplete="off" on input elements, marked as won't fix https://bugs.chromium.org/p/chromium/issues/detail?id=587466

I can make my web site/app extremely hard to use in all sorts of bad ways, the developer being able to disable autocomplete should be the least of anyones worries.

The other side is the situation we have now, autocomplete doing the wrong thing all over the place with no way to stop it. Stomping on my apps specific database driven autocomplete really hurts the user experience. Also autofilling fields without the user noticing and entering wrong data into forms. What a mess.

Re: Safari tries to fill username

#225

Post by lucb1e » Fri, May 28, 2021, 1:32 PM UTC

samjmck wrote: post #60

It _wants_ to autofill, but it doesn't without the user actually confirming the autofill. Pretty important distinction to make I think

Not just that, the "a password" is also not leaking a stored password to a random website that contains this string, it's really just popping up the autofill prompt with the passwords that you explicitly stored for this specific website.

Re: Safari tries to fill username

#226

Post by weswpg » Fri, May 28, 2021, 1:33 PM UTC

teknopaul wrote: post #107

m-p-3 wrote: post #98

Earlier quoted context omitted.

The password booklet can be secure if you have good physical security, and is immune to a software zero-day and autocomplete exploits.

this x 10, computer security is usually flawed, personal security is (bar a few war zones) much better.

there are a lot of war zones in this world though. given that and the number of Third World countries with high levels of crime and poor public security, I suspect that a significant percentage of the worlds technology-using population might have better digital security than physical security

Re: Safari tries to fill username

#227

Post by timw4mail » Fri, May 28, 2021, 1:34 PM UTC

shp0ngle wrote: post #208

oblvious-earth wrote: post #203

Earlier quoted context omitted.

I used to support a client facing app at a bank and the appsec pentesters were a joke: * Username and Password fields must not autocomplete * Username and Password fields must not allow text to be pasted in to the field * Password must be at least 8 characters with lower case, upper case, numbers, and special characters (they didn't care it had a maximum length of 8 characters) I straight up told our project manageme…

Ahhhh, so that's why banks specifically often don't allow automatic filling/pasting. It's because it's in some dumb regulatory pentest manual or something. OK.

I think PCI standards are pointing to some of this nonsensical advice.

Re: Safari tries to fill username

#228

Post by _wldu » Fri, May 28, 2021, 1:34 PM UTC

oblvious-earth wrote: post #203

airza wrote: post #43

Earlier quoted context omitted.

The nuance here is that brain-damaged appsec pentesters reported this as a vulnerability for years, and so tons of websites followed that advice and dutifully disabled the functionality. But autocomplete has advantages: it lets users easily specify long, random, per-site passwords without ever having to worry about that. And when they can't do that, a pretty large percentage of them just give up and write the passwor…

I used to support a client facing app at a bank and the appsec pentesters were a joke: * Username and Password fields must not autocomplete * Username and Password fields must not allow text to be pasted in to the field * Password must be at least 8 characters with lower case, upper case, numbers, and special characters (they didn't care it had a maximum length of 8 characters) I straight up told our project manageme…

This is the continued dilution of security with audit/compliance. It's a mindless, check the box mentality. They don't care about real-world security, they offer insurance to cover the losses. But many insurers are no longer paying due to the volume of incidents and the lack of sound security.

The auditors are typically 10 to 15 years behind technical security expertise.

Re: Safari tries to fill username

#229

Post by lucb1e » Fri, May 28, 2021, 1:34 PM UTC

captainmuon wrote: post #5

Too much magic if you ask me. There are often two ways you can do something. In this case: - Explicit clean markup and a deterministic GUI or - Tons of heuristics and a magic GUI that works great most of the time but fails in ways that are hard to understand. I feel you get this tradeoff a lot in "clever" systems. Whether it is just finding the main text on a page, blocking ads, doing search, or even self-driving car…

What is the "pedestrian" approach to self-driving cars? You mean walking rather than driving?

Re: Safari tries to fill username

#230

Post by airza » Fri, May 28, 2021, 1:35 PM UTC

oblvious-earth wrote: post #203

airza wrote: post #43

Earlier quoted context omitted.

The nuance here is that brain-damaged appsec pentesters reported this as a vulnerability for years, and so tons of websites followed that advice and dutifully disabled the functionality. But autocomplete has advantages: it lets users easily specify long, random, per-site passwords without ever having to worry about that. And when they can't do that, a pretty large percentage of them just give up and write the passwor…

I used to support a client facing app at a bank and the appsec pentesters were a joke: * Username and Password fields must not autocomplete * Username and Password fields must not allow text to be pasted in to the field * Password must be at least 8 characters with lower case, upper case, numbers, and special characters (they didn't care it had a maximum length of 8 characters) I straight up told our project manageme…

It's a problem, to put it mildly. There is humongous growth in this space and not enough skilled people to fill the gap. I'm lucky that my current employer is more discerning but i frequently get reports from previous assessment that are just the results of uninterpreted automatic tooling :(