Safari tries to fill username • Hacker News Board

Re: Safari tries to fill username

#331

Post by akersten » Fri, May 28, 2021, 5:43 PM UTC

ROARosen wrote: post #249

heinrichhartman wrote: post #56

Earlier quoted context omitted.

I tend to side with Chrome here. IMHO, the decision of whether to show auto-complete should be with the user and not with the website. When I install an auto-complete add-on or activate a browser feature, I expect the AC to be available on ALL input fields, whether the site owner thought that would be a good idea or not. Now, there is a valid question on how the user should be able to configure the AC behavior, and h…

> IMHO, the decision of whether to show auto-complete should be with the user and not with the website It;s fundamentally wrong to decide what 'rights' website users have (aside from when it comes to privacy). There are myriad ways how a website can become un-user friendly to the point of being unusable not the least is of which you can completely disable the cursor or completely not display certain parts which are r…

It's especially bad because the holier-than-thou attitude broke real, commonly-used websites , the Chrome team was made aware of the use cases, and they just didn't care. For example, Chrome tried auto-completing my home address into Expedia for where I'd like to vacation.

So it's not even those "corner case big boring CRM business apps" that had to find workarounds to forced-autocomplete, it's "real" user-facing ones too. Very frustrating.

Re: Safari tries to fill username

#332

Post by ChrisMarshallNY » Fri, May 28, 2021, 5:48 PM UTC

hahahasure wrote: post #144

ChrisMarshallNY wrote: post #103

I don't see this as a bug. Password autocomplete is kind of a dumpster fire. It varies, depending on which sites I visit. I use 1Password, with browser integrations (it works better with Safari than Chrome). I don't know most of my passwords; relying on 1Password to access the strings of garbage I autogenerate. So I am constantly using it to fill forms. It keys on things like attached ... elements. Not all sites use…

Apple bug- it's not really a bug I have encountered this mentality often. I'm not sure if Apple users have so many bugs that they are used to it, or if it's part of the fanaticism. I had so many bugs on iphone 6 I was baffled because the marketing "It just works". Upon voicing my issues, I was told from numerous people, "it's probably just doing X,Y,Z". Like that's an acceptable reason for bugs.

> or if it's part of the fanaticism.

Thanks for the insult.

I'm not an "Apple fanatic," but I do develop for the platform.

I don't rail against other platforms (I spent 25 years, managing a cross-platform team), and I would suggest that you may be doing yourself a real disservice by writing off an extremely lucrative venue.

I do support you, however, in demonstrating a commitment to your principles, by ignoring and insulting a gigantic swath of monied customers.

Re: Safari tries to fill username

#333

Post by lostlogin » Fri, May 28, 2021, 5:55 PM UTC

xvolter wrote: post #330

metanonsense wrote: post #262

This is not really a Safari-only thing. All password managers that I have used in the past had some kind of heuristic to decide whether a field should be auto-filled or not. Here is a nice explanation by a (former?) 1Password employee ( https://1password.community/discussion/94198/autocomplete-of... ). To me as a web developer (among other things :D) this is quite annoying because password managers often hijack our f…

This has been annoying for me. I build a healthcare EMR software, and the browser trying to autofill the employee's information into every patient field is often a problem. By accident we end up with patient's phone numbers, addresses, and emails being set to employee's information. Since its software, I don't have control over those employees, but we have had to put in recommendations to disable autofill in browsers…

I’ve made this error and will admit to being utterly baffled the first time I hit it.

As an administrator was trying to work though a users problem. But their account details all matches mine. It took an embarrassing amount of time for it to click.

Re: Safari tries to fill username

#334

Post by juped » Fri, May 28, 2021, 6:08 PM UTC

jwr wrote: post #211

oblvious-earth wrote: post #203

Earlier quoted context omitted.

I used to support a client facing app at a bank and the appsec pentesters were a joke: * Username and Password fields must not autocomplete * Username and Password fields must not allow text to be pasted in to the field * Password must be at least 8 characters with lower case, upper case, numbers, and special characters (they didn't care it had a maximum length of 8 characters) I straight up told our project manageme…

In these cases, it makes sense to point people to NIST Special Publication 800-63B (Digital Identity Guidelines) https://pages.nist.gov/800-63-3/sp800-63b.html — their guidelines are pretty good and eliminate much of the braindead nonsense that is considered "accepted practice in the industry".

Yes, the authors of that document did an great public service in letting us point to an "official government standard".

Re: Safari tries to fill username

#335

Post by NeutronStar » Fri, May 28, 2021, 6:12 PM UTC

dvtrn wrote: post #207

_jal wrote: post #206

Earlier quoted context omitted.

It is normal to get a little confused when you ignore half the comment.

Are you unironically comparing a certification in technology to a license to practice medicine or law?

Given the choice between someone with a license and someone without. The analogy isn't very hard to grasp here...

Re: Safari tries to fill username

#336

Post by fuzzer37 » Fri, May 28, 2021, 6:17 PM UTC

Wowfunhappy wrote: post #288

Vrondi wrote: post #287

Earlier quoted context omitted.

Bad example. They aren't going to interview your son, but _most_ will take his high GPA and certificate of completion of Driver's Education class, and give you a discount for it, which is the next best thing without spending the time to interview him.

But isn't that driver's education class certificate basically a “checkbox”? I don’t think it’s so different from those IT certifications.

I think the difference is that taking a drivers education class, and (in my experience, at least) is that there is actual hands on driving experience. I think an IT certificate or security audit is a lot more abstract.

The only way to check the "Has taken a driving class and has at least 20 hours behind the wheel" is to do just that. How many different ways could you check the "Secure password requirements are enforced by users" box? How many ways could you check the "physical security to encrypted systems" box?

Re: Safari tries to fill username

#337

Post by robertoandred » Fri, May 28, 2021, 6:22 PM UTC

wildrhythms wrote: post #222

HatchedLake721 wrote: post #170

Earlier quoted context omitted.

Can you share details?

Everyone loves CSS grid layout now, right? On Safari (both iOS and OS X) Safari does not support grid-gap, i.e. "gap" CSS property. https://developer.mozilla.org/en-US/docs/Web/CSS/gap#support... I use the fullscreen API to give prototype demos of a product to clients, and iOS [iPhone] Safari doesn't support the fullscreen API. https://developer.mozilla.org/en-US/docs/Web/API/Fullscreen_...

Safari has supported grid-gap since March 2017, the exact same time Chrome and Firefox has. Your statement is completely false.

Re: Safari tries to fill username

#338

Post by throwawayboise » Fri, May 28, 2021, 6:23 PM UTC

DaiPlusPlus wrote: post #329

throwawayboise wrote: post #298

Earlier quoted context omitted.

What is the rationale for disabling paste on passwords, account numbers, other "sensitive" data? The absolute worst are fields where paste is disabled, and the characters are also echoed as "*" so you can't even see what you are typing. I saw this with SSNs when I submitted some tax forms on my state's website recently. The only argument I can think of for disabling paste (and I think it's pretty weak) is on a form t…

> What is the rationale for disabling paste on passwords, account numbers, other "sensitive" data? Cargo-cult internet "security" practices are legion in the retail-banking sector. Like with most things it starts with good-intentions but when modern research suggests better-things the worst of them just knuckle-down with hypertension-inducing results: https://www.troyhunt.com/tag/banks/ TL;DR: * Banks think that havi…

> discouraging users from copying their passwords into their clipboard

Yeah, but what happens in reality is that the user copies the password, and then discovers that paste is disabled. By that time, the password is already on the clipboard.

I don't log in to any particular websites often enough to remember ahead of time which ones let me paste passwords and which ones don't.

Re: Safari tries to fill username

#339

Post by robertoandred » Fri, May 28, 2021, 6:24 PM UTC

realusername wrote: post #14

rimliu wrote: post #11

Earlier quoted context omitted.

There is a browser without bugs?

Not really no but there's a very large tech gap between both Chrome (plus associated) and Firefox and on the other hand Safari which feels like it's in "maintenance mode".

No, there's not.

Re: Safari tries to fill username

#340

Post by kstrauser » Fri, May 28, 2021, 6:29 PM UTC

deergomoo wrote: post #268

oblvious-earth wrote: post #203

Earlier quoted context omitted.

I used to support a client facing app at a bank and the appsec pentesters were a joke: * Username and Password fields must not autocomplete * Username and Password fields must not allow text to be pasted in to the field * Password must be at least 8 characters with lower case, upper case, numbers, and special characters (they didn't care it had a maximum length of 8 characters) I straight up told our project manageme…

I am currently arguing with the bargain-basement pentesters one of our clients hired. They are claiming the system we built is vulnerable because, and I quote, “any credentials sent over HTTPS are transmitted in plain text until they leave the user’s local network”. Not sure how exactly they think HTTPS works, but five minutes on Wikipedia could debunk that one. They also flagged up that users can access JavaScript a…

"Look, I'm going to be honest with you: your pentesters are morons. They're grossly incompetent and should be embarrassed. I can give you a list of qualified alternatives you might want to choose from, and not just to test the work I've done for you, but for all your other projects too. Seriously, their advice is just awful and you really need to switch."

This isn't the time to tread lightly, but to go scorched earth. This isn't an "oh, we disagree on the finer points!" debate between peers kind of situation, but a flat-out "these knuckleheads are putting you at risk and you need to know it". You want to get the point across that you're not messing around or leaving room for doubt.

Source: have had these conversations several times over the years. I normally pride myself on tact, but in my experience tact is the exact wrong approach here as it gives the client the impression that there's a wiggle room of doubt.