Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Safari tries to fill username

github.com

Post reply on HN
Print view View original

361–370 of 393 posts

Re: Safari tries to fill username

#361

Post by brikil »

throwawayboise wrote: post #298
xzel wrote: post #282

Earlier quoted context omitted.

I have/wrote a one line auto hot key script for typing in strings in fields that don’t allow paste. Originally intended for a tax program that doesn’t allow pasting banking passwords. The pain of making a mistake and have to enter a 30+ character password over and over still haunts me. Also, if you have a problem contact their customer support. I had a tweet get a few hundred likes about a non pastable field for a tr…

What is the rationale for disabling paste on passwords, account numbers, other "sensitive" data? The absolute worst are fields where paste is disabled, and the characters are also echoed as "*" so you can't even see what you are typing. I saw this with SSNs when I submitted some tax forms on my state's website recently. The only argument I can think of for disabling paste (and I think it's pretty weak) is on a form t…

The clipboard is accessible from the javascript runtime from any page in any tab. Maybe disabling paste is intended to discourage the behavior?

I think this is also why lastpass clears your clipboard a few moments after you click the “copy to clipboard” button.

Re: Safari tries to fill username

#362

Post by sandgiant »

irae wrote: post #266
metanonsense wrote: post #262

This is not really a Safari-only thing. All password managers that I have used in the past had some kind of heuristic to decide whether a field should be auto-filled or not. Here is a nice explanation by a (former?) 1Password employee ( https://1password.community/discussion/94198/autocomplete-of... ). To me as a web developer (among other things :D) this is quite annoying because password managers often hijack our f…

As well they should. I sometimes hate the password managers too as a web developer. I am also a 1Password user, and I hate sites that block clipboard, block pasting, block right click, basically block any kind of way I have to type even my username, not to mention annoying full size on screen keyboards that can only be used with the mouse. I don't care about the reason they have to be so intrusive in UX, probably som…

NIST actually recommends allowing users to paste exactly for this reason:

> Verifiers SHOULD permit claimants to use “paste” functionality when entering a memorized secret. This facilitates the use of password managers, which are widely used and in many cases increase the likelihood that users will choose stronger memorized secrets.

https://pages.nist.gov/800-63-3/sp800-63b.html

I use the "Don't Fuck With Paste" add on for Chrome/Firefox, which mostly works well.

Re: Safari tries to fill username

#363

Post by slver »

quotemstr wrote: post #324
slver wrote: post #308

Earlier quoted context omitted.

You should sit down and read the reports and realize users are harmed by this.

Are they? I think users are harmed by overzealous webmasters breaking a browser security feature. Sorry, but the people who disabled autocomplete unnecessary ruined that control for everyone.

I thought I told you to sit down and read the reports. Why are you so insistent on speculating based on no information instead of actually reading the specific cases described there?

One app is a kiosk that keeps saving people's passwords and autofilling them for the next user. Another app has its own address dropdown but Chrome hides it and keeps autofilling the same address over and over making the app useless. A third app is for admins creating users, and it keeps autofilling the admin's own details so that info keeps accidentally leaking into the user accounts. Another app is for applying for a bank service with very strict requirements, names get autofilled not following the requirement, users think the autofiller is perfect, then they get rejected and need to go to the branch physically to fix it.

Don't be a know-it-all. Go actually learn something.

Having a browser second-guess its own markup after this markup has already been established to work a certain way is really dangerous. We're talking about the web, the most popular platform in the world, and Chrome is the most popular browser. This is irresponsible handling of that burden from Google to make changes like this on a whim.

Re: Safari tries to fill username

#364

Post by rav »

sandgiant wrote: post #362
irae wrote: post #266

Earlier quoted context omitted.

As well they should. I sometimes hate the password managers too as a web developer. I am also a 1Password user, and I hate sites that block clipboard, block pasting, block right click, basically block any kind of way I have to type even my username, not to mention annoying full size on screen keyboards that can only be used with the mouse. I don't care about the reason they have to be so intrusive in UX, probably som…

NIST actually recommends allowing users to paste exactly for this reason: > Verifiers SHOULD permit claimants to use “paste” functionality when entering a memorized secret. This facilitates the use of password managers, which are widely used and in many cases increase the likelihood that users will choose stronger memorized secrets. https://pages.nist.gov/800-63-3/sp800-63b.html I use the "Don't Fuck With Paste" add…

Here's a bookmarklet version of "Don't mess with paste" for those who don't want to install the add-on:

    javascript:void(document.documentElement.addEventListener(
    'copy',e=>e.stopPropagation(),true),
    document.documentElement.addEventListener(
    'paste',e=>e.stopPropagation(),true))

Re: Safari tries to fill username

#365

Post by mannerheim »

tarsinge wrote: post #189
thomasfortes wrote: post #48

Earlier quoted context omitted.

Both are the new IE, one push features without caring about the rest of the ecosystem and the other refuses to implement standards without caring about the rest of the ecosystem. The end result is that the web right now has stuff that works only on Chrome and stuff that works everywhere besides Safari. And the fact that iOS users can't change their browser forces developers that want their projects to reach the maxim…

> the other refuses to implement standards without caring about the rest of the ecosystem There is standard, and standard as previously Chrome only feature that Firefox felt pressured to implement and was then a posteriori made into a standard.

Pretty much every browser except Safari supports WebGL2

Re: Safari tries to fill username

#367

Post by eurasiantiger »

sipos wrote: post #344
AlfeG wrote: post #310

Earlier quoted context omitted.

Some hired "pentesters" found in our Asp.Net application that "Connection to the prod database is established before the user credentials have been validated.". They even insist that this is come from some ISO security guidelines. Cheese, this one line in their report causes around 3 hours of meetings with around 10-20 people on them... and there were a lot of lines like this.

This is the DB that contains the usernames and (hashed) passwords right? What do they expect? That you have a separate DB for authentication from everything else? What does that achieve? If you DoS the auth DB, you still DoS the application in this scenario.

The application has a much larger attack surface than the auth/user system, so it makes sense to store PII separately.

Re: Safari tries to fill username

#368

Post by toxik »

brikil wrote: post #361
throwawayboise wrote: post #298

Earlier quoted context omitted.

What is the rationale for disabling paste on passwords, account numbers, other "sensitive" data? The absolute worst are fields where paste is disabled, and the characters are also echoed as "*" so you can't even see what you are typing. I saw this with SSNs when I submitted some tax forms on my state's website recently. The only argument I can think of for disabling paste (and I think it's pretty weak) is on a form t…

The clipboard is accessible from the javascript runtime from any page in any tab. Maybe disabling paste is intended to discourage the behavior? I think this is also why lastpass clears your clipboard a few moments after you click the “copy to clipboard” button.

Sounds like a security issue in Javascript to me

Re: Safari tries to fill username

#369

Post by tankenmate »

irae wrote: post #266
metanonsense wrote: post #262

This is not really a Safari-only thing. All password managers that I have used in the past had some kind of heuristic to decide whether a field should be auto-filled or not. Here is a nice explanation by a (former?) 1Password employee ( https://1password.community/discussion/94198/autocomplete-of... ). To me as a web developer (among other things :D) this is quite annoying because password managers often hijack our f…

As well they should. I sometimes hate the password managers too as a web developer. I am also a 1Password user, and I hate sites that block clipboard, block pasting, block right click, basically block any kind of way I have to type even my username, not to mention annoying full size on screen keyboards that can only be used with the mouse. I don't care about the reason they have to be so intrusive in UX, probably som…

For exactly this reason I wrote a script that reads from the clipboard cut buffer and inserts the keys one at a time into the keyboard input stream; voilà, pasting that side steps asinine browser page restrictions.

Re: Safari tries to fill username

#370

Post by quotemstr »

slver wrote: post #363
quotemstr wrote: post #324

Earlier quoted context omitted.

Are they? I think users are harmed by overzealous webmasters breaking a browser security feature. Sorry, but the people who disabled autocomplete unnecessary ruined that control for everyone.

I thought I told you to sit down and read the reports. Why are you so insistent on speculating based on no information instead of actually reading the specific cases described there? One app is a kiosk that keeps saving people's passwords and autofilling them for the next user. Another app has its own address dropdown but Chrome hides it and keeps autofilling the same address over and over making the app useless. A t…

> Don't be a know-it-all. Go actually learn something.

Try again, but with less personal invective. You're listing a few bad things that happen because Chrome ignores autocomplete="off", but you're not listing all the bad things that would happen if Chrome didn't ignore autocomplete="off" --- namely, users using weaker passwords and getting compromised more.

Sorry, all the things you mention sound like minor annoyances to me. It's much more important that websites not block secure password storage features in browsers.

Post reply on HN