Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Safari tries to fill username

github.com

Post reply on HN
Print view View original

231–240 of 393 posts

Re: Safari tries to fill username

#231

Post by chillfox »

cm2187 wrote: post #161
dkdbejwi383 wrote: post #120

Earlier quoted context omitted.

The product I work on now logs users out after 15 minutes. It's a service where the average user would probably spend a good few hours of their day. We're actively harming the user experience (and driving paying customers away) because of some "expert" advice.

The ones that puzzle me even more are the intranet websites that log you off after x minutes whereas they work with single sign on, ie no password entered, so not sure what security benefit that achieves. But they make you lose whatever you were doing in the process.

Usually that comes down to single sign off being a lot harder to do than single sign on. So they just use a timer on each app for the sign off.

Re: Safari tries to fill username

#232

Post by nonsen »

wildrhythms wrote: post #222
HatchedLake721 wrote: post #170

Earlier quoted context omitted.

Can you share details?

Everyone loves CSS grid layout now, right? On Safari (both iOS and OS X) Safari does not support grid-gap, i.e. "gap" CSS property. https://developer.mozilla.org/en-US/docs/Web/CSS/gap#support... I use the fullscreen API to give prototype demos of a product to clients, and iOS [iPhone] Safari doesn't support the fullscreen API. https://developer.mozilla.org/en-US/docs/Web/API/Fullscreen_...

I believe you can use the PWA mode for fullscreen (Share > Add to homescreen)

Re: Safari tries to fill username

#233

Post by qwertox »

himinlomax wrote: post #146
airza wrote: post #43

Earlier quoted context omitted.

The nuance here is that brain-damaged appsec pentesters reported this as a vulnerability for years, and so tons of websites followed that advice and dutifully disabled the functionality. But autocomplete has advantages: it lets users easily specify long, random, per-site passwords without ever having to worry about that. And when they can't do that, a pretty large percentage of them just give up and write the passwor…

I don't even know if it was security consultants who ever recommended that. It's the same thing with disabling pasting into password fields. A lot of websites used to do that, many probably still do, but I have never seen a security team, no matter how braindead, recommend that nonsense. Rather, it's well-intentioned but stupid project managers following industry worst practices. You can't get in trouble for doing wh…

This really used to be an issue when some JavaScript code constantly checked for new data in those inputs in hopes to find something interesting, like some personal info which shouldn't be there.

But I fully agree with the disable-paste stuff. Very few (web-related) things get as annoying as that.

Re: Safari tries to fill username

#234

Post by pavel_lishin »

rhdunn wrote: post #69
heinrichhartman wrote: post #56

Earlier quoted context omitted.

I tend to side with Chrome here. IMHO, the decision of whether to show auto-complete should be with the user and not with the website. When I install an auto-complete add-on or activate a browser feature, I expect the AC to be available on ALL input fields, whether the site owner thought that would be a good idea or not. Now, there is a valid question on how the user should be able to configure the AC behavior, and h…

The problem is when the web browser gets it wrong and decides to show autocomplete for an unrelated field, or a field that is not a login/enter password page. Some examples I've had to deal with: 1. A "name" field on a dialog for creating values in a controlled vocabulary (e.g. genres in fiction) -- Chrome thinks this is a username field so brings up a user autocomplete. I guess it thinks that "Jane Smith" is a valid…

Another great example is github - for awhile, trying to request a review from someone on a pull request would cause LastPass to "helpfully" pop up and prompt for an auto-fill, completely obscuring the list of users underneath.

Re: Safari tries to fill username

#235

Post by musingsole »

lucb1e wrote: post #229
captainmuon wrote: post #5

Too much magic if you ask me. There are often two ways you can do something. In this case: - Explicit clean markup and a deterministic GUI or - Tons of heuristics and a magic GUI that works great most of the time but fails in ways that are hard to understand. I feel you get this tradeoff a lot in "clever" systems. Whether it is just finding the main text on a page, blocking ads, doing search, or even self-driving car…

What is the "pedestrian" approach to self-driving cars? You mean walking rather than driving?

Rail or line following might be a more "pedestrian" approach to self-driving cars.

Re: Safari tries to fill username

#236

Post by alistairSH »

cactus2093 wrote: post #176
Cthulhu_ wrote: post #131

Earlier quoted context omitted.

After 15 minutes, or 15 minutes of inactivity? The latter is defensible at least, in e.g. a public area where there is a risk of people leaving their desktops without locking them. I mean that's another policy issue that can be addressed (a policy that locks a system after x amount of inactivity), but as an app developer you can't know much about the system things are running on.

But should all sites really be optimized for the user at a public library computer? At the expense of convenience for the large majority of users that are on a personal or work computer? Doesn’t make much sense to me. Also the computer itself solves this problem for you in many cases, a guest profile typically deletes all browser session info when you log out.

All sites? Probably not.

Many sites? Probably.

You're assuming people log out reliably or otherwise behave in the most secure way. They don't.

I also don't see how logging out/killing a session after 15 minutes of inactivity is much of a hardship for the user.

Re: Safari tries to fill username

#238

Post by jinpalmer »

busymom0 wrote: post #142

The title is clickbait. Both "welcome back" and "Sign In" show the blue outline around the field and safari asks the user to select a username in the dropdown without actually filling the field. The user needs to actively click on the username for safari to fill the field. I don't see how this is "bad behaviour". Seems like expected behaviour.

Your no. 1 reason is being questioned by the article, though.

Re: Safari tries to fill username

#240

Post by candylifter »

reynard_le_faux wrote: post #22
raverbashing wrote: post #20

I can see the PM with this story "As a user I want to feel welcome back to my websites hence my login information will be auto-filled if the sites welcome me back" (Though the real issue here seems to be field identification, not the auto-fill)

Yes. I thought changing the field to type="search" may avoid it but alas no.

changing the name attribute seems to work, e.g. name="search"
Post reply on HN