Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Safari tries to fill username

github.com

Post reply on HN
Print view View original

311–320 of 393 posts

Re: Safari tries to fill username

#311

Post by rad_gruchalski »

throwawayboise wrote: post #298
xzel wrote: post #282

Earlier quoted context omitted.

I have/wrote a one line auto hot key script for typing in strings in fields that don’t allow paste. Originally intended for a tax program that doesn’t allow pasting banking passwords. The pain of making a mistake and have to enter a 30+ character password over and over still haunts me. Also, if you have a problem contact their customer support. I had a tweet get a few hundred likes about a non pastable field for a tr…

What is the rationale for disabling paste on passwords, account numbers, other "sensitive" data? The absolute worst are fields where paste is disabled, and the characters are also echoed as "*" so you can't even see what you are typing. I saw this with SSNs when I submitted some tax forms on my state's website recently. The only argument I can think of for disabling paste (and I think it's pretty weak) is on a form t…

> you might want to make the user actually type the same password twice, rather than let them copy/paste the first entry into the second field

Please no. I generate a password in bitwarden, save it, copy and paste twice. Don't do that. I really don't want to type a 24 character password with lower / upper letters and special characters. If you do that to me, I will leave your website and never come back.

Re: Safari tries to fill username

#313

Post by _jal »

dvtrn wrote: post #285
OldTimeCoffee wrote: post #244

Earlier quoted context omitted.

You may have missed the point being made. You find a good security professional the same way you find a good lawyer or doctor. Ask around for a reference for a good one. Then check their credentials (e.g., what certifications they have). I believe there was an article on HN recently about a startup that used a "lawyer" that wasn't because they didn't check their credentials after getting a great reference. Just becau…

You may have missed the point being made I feel quite certain that I haven't, I just think the point is poorly made and I've spoken specifically to why I think that to be the case. You can get all the recommendations and referrals you want for an infosec professional; nothing stops that person from holding themselves out to be such a professional, quality of work or competency performing it notwithstanding. You can a…

> I feel quite certain

People who are wrong usually do.

> You can get all the recommendations and referrals you want for an infosec professional; nothing stops that person from holding themselves out

Here is where you missed the point.

You are correct that we do not license, say, pen testers the same way we license doctors. You are incorrect in thinking that this matters.

The point is that in both cases, reputation is the best general-purpose measure of who you want. That's all.

My mentioning certs may have steered you wrong, and that was a bit of a distraction. My point there was that certs tell us something, usually not much, but are still better indicators than their self-advertising.

Re: Safari tries to fill username

#315

Post by throwawayboise »

rad_gruchalski wrote: post #311
throwawayboise wrote: post #298

Earlier quoted context omitted.

What is the rationale for disabling paste on passwords, account numbers, other "sensitive" data? The absolute worst are fields where paste is disabled, and the characters are also echoed as "*" so you can't even see what you are typing. I saw this with SSNs when I submitted some tax forms on my state's website recently. The only argument I can think of for disabling paste (and I think it's pretty weak) is on a form t…

> you might want to make the user actually type the same password twice, rather than let them copy/paste the first entry into the second field Please no. I generate a password in bitwarden, save it, copy and paste twice. Don't do that. I really don't want to type a 24 character password with lower / upper letters and special characters. If you do that to me, I will leave your website and never come back.

I do agree -- it was just the only semi-reasonable argument I could think of. It probably made some amount of sense before password managers were really a common thing, and you wanted to be sure that users didn't typo a new password and lock themselves out of accounts.

Re: Safari tries to fill username

#316

Post by calebporzio »

Livewire's creator here. This problem is so bonkers and such a pain to deal with.

For your amusement. Here's the code that was SUPPOSED to fix the bug: https://github.com/livewire/livewire/blob/0b3feda46a9dd6ad19...

https://github.com/livewire/livewire/blob/0b3feda46a9dd6ad19...

And here's the podcast I recorded a while back on what a pain it is: https://laravel-livewire.com/podcasts/ep65-safari-sucks-here...

Re: Safari tries to fill username

#317

Post by dvtrn »

_jal wrote: post #313
dvtrn wrote: post #285

Earlier quoted context omitted.

You may have missed the point being made I feel quite certain that I haven't, I just think the point is poorly made and I've spoken specifically to why I think that to be the case. You can get all the recommendations and referrals you want for an infosec professional; nothing stops that person from holding themselves out to be such a professional, quality of work or competency performing it notwithstanding. You can a…

> I feel quite certain People who are wrong usually do. > You can get all the recommendations and referrals you want for an infosec professional; nothing stops that person from holding themselves out Here is where you missed the point. You are correct that we do not license, say, pen testers the same way we license doctors. You are incorrect in thinking that this matters. The point is that in both cases, reputation i…

Let's dispense with the "right or wrong" aspect of this, because I don't think it's helpful towards moving the needle on this, and instead evaluate this as a matter of complementary perspectives.

Does reputation matter? Yes. This I will openly concede. Do I think credentials are meaningless? No.

Where we disagree is "thinking that this matters". I still think it absolutely does, and think the analogy is a poor one. You clearly think it doesn't, that's fine, but I don't think it makes either one of us less or more wrong. Perhaps that's all there is at play here, a difference of opinion in how an organization prosecutes the search for a qualified expert in security, medicine or law; and I think it's revealingly disingenuous to frame such organizational decision making and risk tolerances when seeking professional services with rigid and inflexible absolutes of "right way" or "wrong way" or whether or not method A matters whereas method B doesn't.

Re: Safari tries to fill username

#318

Post by deergomoo »

dec0dedab0de wrote: post #293
deergomoo wrote: post #268

Earlier quoted context omitted.

I am currently arguing with the bargain-basement pentesters one of our clients hired. They are claiming the system we built is vulnerable because, and I quote, “any credentials sent over HTTPS are transmitted in plain text until they leave the user’s local network”. Not sure how exactly they think HTTPS works, but five minutes on Wikipedia could debunk that one. They also flagged up that users can access JavaScript a…

wait, so what do they suggest you do instead?

For the HTTPS thing, they’re suggesting client-side encryption. Which, to me, seems to be a combination of no real benefit and opens a window to introduce vulnerabilities if we get anything wrong.

Interestingly, I checked a few big sites, and while Google doesn’t, Facebook and Amazon both use client-side encryption. Is it just to provide some extra protection for pwned users who have trusted bad certs? I’m no security expert, and I’m struggling to think of any real benefit.

For the JS/CSS thing, I have literally no idea.

Re: Safari tries to fill username

#319

Post by [deleted] »

dvtrn wrote: post #285
OldTimeCoffee wrote: post #244

Earlier quoted context omitted.

You may have missed the point being made. You find a good security professional the same way you find a good lawyer or doctor. Ask around for a reference for a good one. Then check their credentials (e.g., what certifications they have). I believe there was an article on HN recently about a startup that used a "lawyer" that wasn't because they didn't check their credentials after getting a great reference. Just becau…

You may have missed the point being made I feel quite certain that I haven't, I just think the point is poorly made and I've spoken specifically to why I think that to be the case. You can get all the recommendations and referrals you want for an infosec professional; nothing stops that person from holding themselves out to be such a professional, quality of work or competency performing it notwithstanding. You can a…

[deleted]

Re: Safari tries to fill username

#320

Post by deergomoo »

geoduck14 wrote: post #275
deergomoo wrote: post #268

Earlier quoted context omitted.

I am currently arguing with the bargain-basement pentesters one of our clients hired. They are claiming the system we built is vulnerable because, and I quote, “any credentials sent over HTTPS are transmitted in plain text until they leave the user’s local network”. Not sure how exactly they think HTTPS works, but five minutes on Wikipedia could debunk that one. They also flagged up that users can access JavaScript a…

>any credentials sent over HTTPS are transmitted in plain text Hummmm. So a couple of years back, I was working on some internal tools that passed sensitive information around and I found some interesting info. Some bloggers INCORRECTLY thought that HTTPS didn't secure the URL Flags. Correct fact: parameters passed in the URL like ?item=bla is encrypted Also, some cloud providers aload Balancers (AWS) allow you to of…

> Also, some cloud providers aload Balancers (AWS) allow you to offer load HTTPS encryption/decryption - so there REALLY IS plain text stuff in the final leg of the journey

At first I thought this must have been what they meant; perhaps there was some configuration thing we got wrong.

So we asked for clarification and nope, the example given was that someone logging in from an office could have their credentials sniffed freely by anyone else on the office LAN.

Post reply on HN