Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Safari tries to fill username

github.com

Post reply on HN
Print view View original

351–360 of 393 posts

Re: Safari tries to fill username

#351

Post by agogdog »

mjthompson wrote: post #39
yvoschaap wrote: post #18

Earlier quoted context omitted.

Yes. The Chrome devs refuse to accept there are viable cases for not allowing autocomplete.

I'm sure there are valid reasons. Unfortunately, many sites disable it without a good reason, and in those cases, I am glad Chrome hinders their misguided efforts. Many banks, for instance, think password managers are bad and disable it. Chrome preventing them doing so is a good thing.

Ignoring spec isn't the way to solve that problem. You complain to the people who are breaking spec.

Google isn't the arbiter of how the internet works, but they love to act like they are.

Re: Safari tries to fill username

#352

Post by agogdog »

orangepanda wrote: post #47
yvoschaap wrote: post #18

Earlier quoted context omitted.

Yes. The Chrome devs refuse to accept there are viable cases for not allowing autocomplete.

Are there any viable cases?

I worked on a site once that had mailing addresses autofilled into an anonymous survey field. It's a big vector for accidentally leaking personal information.

Re: Safari tries to fill username

#353

Post by realusername »

robertoandred wrote: post #337
wildrhythms wrote: post #222

Earlier quoted context omitted.

Everyone loves CSS grid layout now, right? On Safari (both iOS and OS X) Safari does not support grid-gap, i.e. "gap" CSS property. https://developer.mozilla.org/en-US/docs/Web/CSS/gap#support... I use the fullscreen API to give prototype demos of a product to clients, and iOS [iPhone] Safari doesn't support the fullscreen API. https://developer.mozilla.org/en-US/docs/Web/API/Fullscreen_...

Safari has supported grid-gap since March 2017, the exact same time Chrome and Firefox has. Your statement is completely false.

Gap support in Safari is only there since April 2021 (last month) and because the usage is still close to zero you can't use it. https://caniuse.com/?search=gap

Re: Safari tries to fill username

#354

Post by robertoandred »

realusername wrote: post #353
robertoandred wrote: post #337

Earlier quoted context omitted.

Safari has supported grid-gap since March 2017, the exact same time Chrome and Firefox has. Your statement is completely false.

Gap support in Safari is only there since April 2021 (last month) and because the usage is still close to zero you can't use it. https://caniuse.com/?search=gap

Gap is not grid-gap, and what was added was specifically for gap in flex containers.

Re: Safari tries to fill username

#355

Post by robertoandred »

realusername wrote: post #349
robertoandred wrote: post #339

Earlier quoted context omitted.

No, there's not.

Just have a look at the latest release: https://webkit.org/blog/11648/new-webkit-features-in-safari-... . Most of those features are at least 5 years late. And there's all the quirks additionally to all of that.

Chrome got flex gap a year ago, Firefox got Paint Timing and Intl stuff a few months ago, Chrome doesn't have individual transforms yet, Firefox doesn't have private class fields yet, and Safari supported Web Speech years before either Chrome or Firefox.

I suspect you either didn't read those release notes fully or you don't fully understand what they mean.

Re: Safari tries to fill username

#356

Post by Brian_K_White »

metanonsense wrote: post #262

This is not really a Safari-only thing. All password managers that I have used in the past had some kind of heuristic to decide whether a field should be auto-filled or not. Here is a nice explanation by a (former?) 1Password employee ( https://1password.community/discussion/94198/autocomplete-of... ). To me as a web developer (among other things :D) this is quite annoying because password managers often hijack our f…

Fine if there was a field there. This is creating a field where there was none.

And it's the browser itself rather than an electively installed plugin where you asked for it.

It's outrageous. By rights, modifying the content this way should be seen as utterly outrageous by both site authers and users, not just some quirky glitch that it's not smart enough and doing the modification in the wrong place sometimes and will shortly be improved to false-positive less often.

Re: Safari tries to fill username

#357

Post by joshuaissac »

XCSme wrote: post #263
heinrichhartman wrote: post #56

Earlier quoted context omitted.

I tend to side with Chrome here. IMHO, the decision of whether to show auto-complete should be with the user and not with the website. When I install an auto-complete add-on or activate a browser feature, I expect the AC to be available on ALL input fields, whether the site owner thought that would be a good idea or not. Now, there is a valid question on how the user should be able to configure the AC behavior, and h…

No, the website should have the option to overwrite the browser decision. For example, for a multiplayer game I worked on, you could set a password when you create a private room in the game. The browser always auto-filled it with your account password, which is definitely not good because you have to share the room password with others. Telling the browser to not autocomplete that filled didn't work, because "the br…

For this specific case, the website could generate a password on room creation and show it to the user in a non-editable field.

Re: Safari tries to fill username

#358

Post by XCSme »

joshuaissac wrote: post #357
XCSme wrote: post #263

Earlier quoted context omitted.

No, the website should have the option to overwrite the browser decision. For example, for a multiplayer game I worked on, you could set a password when you create a private room in the game. The browser always auto-filled it with your account password, which is definitely not good because you have to share the room password with others. Telling the browser to not autocomplete that filled didn't work, because "the br…

For this specific case, the website could generate a password on room creation and show it to the user in a non-editable field.

Users want to choose the password themselves because they have to share it with others, so they usually create a funny password.

Re: Safari tries to fill username

#359

Post by thaumasiotes »

jimktrains2 wrote: post #117
thaumasiotes wrote: post #96

Earlier quoted context omitted.

A password is information, something that can be freely duplicated. The idea of "something you have" is that the thing can't be duplicated. As soon as it can, it's no longer "something you have". Any number of people might have it. A person who has it might not be you. SMS hijacking, for example, converts your phone-based authentication to a password, where the password is your phone number. (Since an attacker who kn…

I would argue that since the totp secret is never in my head it is not a password. Sms hijacking doesn't "convert" anything anymore than someone with a telephoto lens "converts" an old-style hardware token to a password. (Yes, I know the p in otp is password, and called that because it's entered by the user. It's not a password in terms of a factor you "know" because it's time-limited.) These are also fluid ideas tha…

> Sms hijacking doesn't "convert" anything anymore than someone with a telephoto lens "converts" an old-style hardware token to a password.

I didn't notice this sentence before. Compare the issue of releasing photographs of master keys.

https://www.schneier.com/blog/archives/2012/10/master_keys.h...

Compare the (correct) comment from that post:

> the press has helpfully published a photograph of the keys, so you can make your own, even if you didn’t win the eBay auction.

with this official statement from the government of New York:

> “If you’re selling it, it’s in your possession for an unlawful reason,” said City Councilmember Elizabeth Crowley, chairwoman of the Fire and Criminal Justice committee.

( https://nypost.com/2015/09/20/the-8-key-that-can-open-new-yo... )

Saying "you're not supposed to have this" won't stop people from having it. These keys are regulated as if they are "something you have", but the facts are otherwise.

Re: Safari tries to fill username

#360

Post by northerdome »

Autocomplete is a black box. Trying to build a form that consistently works with Autocomplete is basically just trial and error. There should be a standardized API for this. I understand trying to support pages that weren't built with support but it's frustrating that there is no programmatic way of defining how autofill works with your app.
Post reply on HN