341–350 of 393 posts
Earlier quoted context omitted.
I guess there are just too many pages that break autocomplete, e.g. for username/password as a "security feature". I encountered quite a few myself and was very annoyed. I guess devs took the "usability" side of the question. EDIT: phrasing
But it’s not useable at all. A form without autocomplete is perfectly useable. A form with autocomplete where it’s not wanted is an absolute hindrance.
Earlier quoted context omitted.
In these cases, it makes sense to point people to NIST Special Publication 800-63B (Digital Identity Guidelines) https://pages.nist.gov/800-63-3/sp800-63b.html — their guidelines are pretty good and eliminate much of the braindead nonsense that is considered "accepted practice in the industry".
Taken to the extreme is the US Government's TreasuryDirect website, where individuals can buy savings bonds. Instead of allowing you to type your password, they render a "virtual keyboard" that you have to use your mouse to click the keys one by one. Oh, and that password? Not case sensitive.
Earlier quoted context omitted.
What is the rationale for disabling paste on passwords, account numbers, other "sensitive" data? The absolute worst are fields where paste is disabled, and the characters are also echoed as "*" so you can't even see what you are typing. I saw this with SSNs when I submitted some tax forms on my state's website recently. The only argument I can think of for disabling paste (and I think it's pretty weak) is on a form t…
When I used to have a multi-monitor dev environment, I did accidentally paste a password into Slack (left screen) and not Chrome (right screen). Immediately deleted the chat message and had to cycle the password. This is the only issue I've ever had with copy/pasting passwords, it only happened once, and the site preventing me from pasting would have done nothing to prevent it. I don't understand the rationale either…
Earlier quoted context omitted.
I am currently arguing with the bargain-basement pentesters one of our clients hired. They are claiming the system we built is vulnerable because, and I quote, “any credentials sent over HTTPS are transmitted in plain text until they leave the user’s local network”. Not sure how exactly they think HTTPS works, but five minutes on Wikipedia could debunk that one. They also flagged up that users can access JavaScript a…
Some hired "pentesters" found in our Asp.Net application that "Connection to the prod database is established before the user credentials have been validated.". They even insist that this is come from some ISO security guidelines. Cheese, this one line in their report causes around 3 hours of meetings with around 10-20 people on them... and there were a lot of lines like this.
Earlier quoted context omitted.
What is the rationale for disabling paste on passwords, account numbers, other "sensitive" data? The absolute worst are fields where paste is disabled, and the characters are also echoed as "*" so you can't even see what you are typing. I saw this with SSNs when I submitted some tax forms on my state's website recently. The only argument I can think of for disabling paste (and I think it's pretty weak) is on a form t…
When I used to have a multi-monitor dev environment, I did accidentally paste a password into Slack (left screen) and not Chrome (right screen). Immediately deleted the chat message and had to cycle the password. This is the only issue I've ever had with copy/pasting passwords, it only happened once, and the site preventing me from pasting would have done nothing to prevent it. I don't understand the rationale either…
Earlier quoted context omitted.
Apple bug- it's not really a bug I have encountered this mentality often. I'm not sure if Apple users have so many bugs that they are used to it, or if it's part of the fanaticism. I had so many bugs on iphone 6 I was baffled because the marketing "It just works". Upon voicing my issues, I was told from numerous people, "it's probably just doing X,Y,Z". Like that's an acceptable reason for bugs.
> or if it's part of the fanaticism. Thanks for the insult. I'm not an "Apple fanatic," but I do develop for the platform. I don't rail against other platforms (I spent 25 years, managing a cross-platform team), and I would suggest that you may be doing yourself a real disservice by writing off an extremely lucrative venue. I do support you, however, in demonstrating a commitment to your principles, by ignoring and i…
I do feel for your plight. At one point I was making an App for my side hobby and was dreading the moment I needed to compile for iOS. (I had recently used a butterfly keyboard.)
Just another day in web development with Safari, I'm not even surprised anymore. I've encountered so many of those "total nonsense" moments.
Note that other commenters have shared examples of the same basic behavior in chrome and Firefox.
Earlier quoted context omitted.
I have/wrote a one line auto hot key script for typing in strings in fields that don’t allow paste. Originally intended for a tax program that doesn’t allow pasting banking passwords. The pain of making a mistake and have to enter a 30+ character password over and over still haunts me. Also, if you have a problem contact their customer support. I had a tweet get a few hundred likes about a non pastable field for a tr…
I'm pretty sure Keepass/Keepassx etc do this
Earlier quoted context omitted.
Not really no but there's a very large tech gap between both Chrome (plus associated) and Firefox and on the other hand Safari which feels like it's in "maintenance mode".
No, there's not.
And there's all the quirks additionally to all of that.
Earlier quoted context omitted.
Because you develop on Chrome, and only occasionally test on Safari. Try the other way around and see which one is buggy.
I think this really needs to be emphasized strongly. I develop primarily on Safari, and only occasionally test on Chrome (for my hobby side project), and occasionally I run into instances where Chrome differs. To me, those look like Chrome bugs because Safari is my "default". If you're using Chrome (or Firefox, which, in my recent experience, tries specifically to be compatible with Chrome because Chrome is the overw…
For the tags I do agree but for the Javascript I have a good bunch of pollyfills just for Safari in place.
> That realusername has to dig up four fairly esoteric edge-case issues to show that Safari is "total nonsense", and then have HatchedLake point out that at least two of those aren't even current, is ample proof that it's the comparison of IE to Safari that's total nonsense.
All of those issues are current and very much not fixed. Yeah they are very old and have been there for almost 10 years I do agree, but it's still broken now, even after 10 years.