Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Safari tries to fill username

github.com

Post reply on HN
Print view View original

291–300 of 393 posts

Re: Safari tries to fill username

#291

Post by vidarh »

deergomoo wrote: post #268
oblvious-earth wrote: post #203

Earlier quoted context omitted.

I used to support a client facing app at a bank and the appsec pentesters were a joke: * Username and Password fields must not autocomplete * Username and Password fields must not allow text to be pasted in to the field * Password must be at least 8 characters with lower case, upper case, numbers, and special characters (they didn't care it had a maximum length of 8 characters) I straight up told our project manageme…

I am currently arguing with the bargain-basement pentesters one of our clients hired. They are claiming the system we built is vulnerable because, and I quote, “any credentials sent over HTTPS are transmitted in plain text until they leave the user’s local network”. Not sure how exactly they think HTTPS works, but five minutes on Wikipedia could debunk that one. They also flagged up that users can access JavaScript a…

I had someone complaint they could ping the public address of our load balancer.

I sent the client back a list of government and military websites that responds to ping. As an extra bonus, it turned out the pentesters own website responded to ping.

Re: Safari tries to fill username

#292

Post by Vrondi »

PebblesRox wrote: post #147
izacus wrote: post #62

Earlier quoted context omitted.

Oh man, enterprise "security" firms used by banks and other old behemoths are a cancer for users. If you want your website to actively abuse users (especially one with special needs and pretty much anyone that doesn't fit into an "made up average person mold") get those people on board and listen to the dumb things they say. I still can't believe that whole business managed to interpret 2FA for whole EU as "you MUST…

I use Coface for work to check credit for potential customers. Instead of a password, they require a 6-digit pin. It can't be auto-filled or entered with the keyboard. There's an on-screen number pad that you have to click on and the numbers are scrambled - they show up in a different arrangement every time. Such a pain!

So, they never want users with a disability to be able to use their site. Nice.

Re: Safari tries to fill username

#293

Post by dec0dedab0de »

deergomoo wrote: post #268
oblvious-earth wrote: post #203

Earlier quoted context omitted.

I used to support a client facing app at a bank and the appsec pentesters were a joke: * Username and Password fields must not autocomplete * Username and Password fields must not allow text to be pasted in to the field * Password must be at least 8 characters with lower case, upper case, numbers, and special characters (they didn't care it had a maximum length of 8 characters) I straight up told our project manageme…

I am currently arguing with the bargain-basement pentesters one of our clients hired. They are claiming the system we built is vulnerable because, and I quote, “any credentials sent over HTTPS are transmitted in plain text until they leave the user’s local network”. Not sure how exactly they think HTTPS works, but five minutes on Wikipedia could debunk that one. They also flagged up that users can access JavaScript a…

wait, so what do they suggest you do instead?

Re: Safari tries to fill username

#294

Post by alistairSH »

fauigerzigerk wrote: post #281
alistairSH wrote: post #236

Earlier quoted context omitted.

All sites? Probably not. Many sites? Probably. You're assuming people log out reliably or otherwise behave in the most secure way. They don't. I also don't see how logging out/killing a session after 15 minutes of inactivity is much of a hardship for the user.

I hate _all_ sites that do this and I actively avoid them. There are many very good reasons why I might not be able to complete a form without interruption. It's not for them second guess me. And it's not just extremely annoying, it's also completely unnecessary. Just put a "trust this browser" checkbox on the sign-in page and adjust the session timeout accordingly.

Just put a "trust this browser" checkbox on the sign-in page and adjust the session timeout accordingly.

That works. It defaults to the "safe" behavior, but allows users to self-select into other behavior that they find less objectionable.

FWIW, my end-users are using public computer labs, so we have to build for the worst-case in terms of user security habits.

Re: Safari tries to fill username

#295

Post by pmontra »

_wldu wrote: post #228
oblvious-earth wrote: post #203

Earlier quoted context omitted.

I used to support a client facing app at a bank and the appsec pentesters were a joke: * Username and Password fields must not autocomplete * Username and Password fields must not allow text to be pasted in to the field * Password must be at least 8 characters with lower case, upper case, numbers, and special characters (they didn't care it had a maximum length of 8 characters) I straight up told our project manageme…

This is the continued dilution of security with audit/compliance. It's a mindless, check the box mentality. They don't care about real-world security, they offer insurance to cover the losses. But many insurers are no longer paying due to the volume of incidents and the lack of sound security. The auditors are typically 10 to 15 years behind technical security expertise.

> The auditors are typically 10 to 15 years behind technical security expertise.

Probably not, but they are there to be paid by their customers. Does the customer have to mark a checkbox on a regulatory form? Give the customer some answer which is not blatantly false or useless, get the money, come back next year.

Re: Safari tries to fill username

#296

Post by missblit »

detaro wrote: post #283
Hackbraten wrote: post #280

Earlier quoted context omitted.

> Some bloggers INCORRECTLY thought that HTTPS didn't secure the URL Flags. Correct fact: parameters passed in the URL like ?item=bla is encrypted It’s still good practice to keep sensitive info out of URL query parameters, which often leak into server logs.

And are (were, maybe modern browsers fixed that by now?) sent in HTTP Referers to linked sites, end up in browser history, ...

The current default for the Referer header is to send the complete referrer for same-origin requests, to send the origin for cross-origin requests, and to send nothing if going from HTTPS to HTTP.

This is customizable by setting the referrer policy: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Re...

Re: Safari tries to fill username

#298

Post by throwawayboise »

xzel wrote: post #282
irae wrote: post #266

Earlier quoted context omitted.

As well they should. I sometimes hate the password managers too as a web developer. I am also a 1Password user, and I hate sites that block clipboard, block pasting, block right click, basically block any kind of way I have to type even my username, not to mention annoying full size on screen keyboards that can only be used with the mouse. I don't care about the reason they have to be so intrusive in UX, probably som…

I have/wrote a one line auto hot key script for typing in strings in fields that don’t allow paste. Originally intended for a tax program that doesn’t allow pasting banking passwords. The pain of making a mistake and have to enter a 30+ character password over and over still haunts me. Also, if you have a problem contact their customer support. I had a tweet get a few hundred likes about a non pastable field for a tr…

What is the rationale for disabling paste on passwords, account numbers, other "sensitive" data?

The absolute worst are fields where paste is disabled, and the characters are also echoed as "*" so you can't even see what you are typing. I saw this with SSNs when I submitted some tax forms on my state's website recently.

The only argument I can think of for disabling paste (and I think it's pretty weak) is on a form to set a new password, where you need to input the password twice (and the form validates that they match) you might want to make the user actually type the same password twice, rather than let them copy/paste the first entry into the second field.

Re: Safari tries to fill username

#300

Post by jolux »

emodendroket wrote: post #276
jolux wrote: post #261

Earlier quoted context omitted.

> Oh, and that password? Not case sensitive. What, you expect them to make a case-sensitive version of NTFS just to store your password??

NTFS is case-sensitive.

I think it’s internally case sensitive and provides case insensitive APIs to users, right?
Post reply on HN