Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Safari tries to fill username

github.com

Post reply on HN
Print view View original

371–380 of 393 posts

Re: Safari tries to fill username

#371

Post by ascar »

_jal wrote: post #205
PebblesRox wrote: post #147

Earlier quoted context omitted.

I use Coface for work to check credit for potential customers. Instead of a password, they require a 6-digit pin. It can't be auto-filled or entered with the keyboard. There's an on-screen number pad that you have to click on and the numbers are scrambled - they show up in a different arrangement every time. Such a pain!

I think this is the manifestation of non-logical associations humans make. When I was a kid, a teacher told me learning was supposed to be hard and unpleasant, and I believed her for a long time. Only when I started enjoying myself in spite of that did I see it was wrong, and I started doing well in school, and (more importantly) pursuing my own interests. There's a similar thing with security - people assume good se…

I always associated these with key logging prevention. What drives me nuts however, is websites/apps that allow me to type my password but not paste it. Like they want to force that a keylogger can grab it?

Another favorite of mine are password conposition rules, which do nothing but reduce security and are everywhere :(

Re: Safari tries to fill username

#372

Post by msbarnett »

brikil wrote: post #361
throwawayboise wrote: post #298

Earlier quoted context omitted.

What is the rationale for disabling paste on passwords, account numbers, other "sensitive" data? The absolute worst are fields where paste is disabled, and the characters are also echoed as "*" so you can't even see what you are typing. I saw this with SSNs when I submitted some tax forms on my state's website recently. The only argument I can think of for disabling paste (and I think it's pretty weak) is on a form t…

The clipboard is accessible from the javascript runtime from any page in any tab. Maybe disabling paste is intended to discourage the behavior? I think this is also why lastpass clears your clipboard a few moments after you click the “copy to clipboard” button.

JS has write-only access to the clipboard, for precisely this reason. It would be a security disaster if JS could snoop your clipboard.

Lastpass and other password managers like 1password wipe the clipboard after a few seconds to minimize native app access to the secret.

Re: Safari tries to fill username

#373

Post by Aeolun »

noja wrote: post #179
Aeolun wrote: post #173

Earlier quoted context omitted.

I do not. Ultimately it is up to the website owners, it shouldn’t be ignored by the browser if it’s part of the spec.

Why do you think it is up to website owners, and not website users?

The website users do not write the HTML? They can set their browser to override whatever they want, but it should not be the default.

Re: Safari tries to fill username

#374

Post by Wowfunhappy »

fuzzer37 wrote: post #336
Wowfunhappy wrote: post #288

Earlier quoted context omitted.

But isn't that driver's education class certificate basically a “checkbox”? I don’t think it’s so different from those IT certifications.

I think the difference is that taking a drivers education class, and (in my experience, at least) is that there is actual hands on driving experience. I think an IT certificate or security audit is a lot more abstract. The only way to check the "Has taken a driving class and has at least 20 hours behind the wheel" is to do just that. How many different ways could you check the "Secure password requirements are enforc…

Totally—but I think that's actually what leads to the dumbest requirements people are complaining about. "Don't allow autofill." "Don't allow pasting passwords." "All passwords must contain at least five special characters and your first born son." Those are boxes that can only be checked one way.

I'm not quite sure where I'm going with this. Something about, maybe things are broken because they don't fit in the insurance company model, and someone needs to solve for that before anything gets better.

Re: Safari tries to fill username

#375

Post by thamer »

mannerheim wrote: post #365
tarsinge wrote: post #189

Earlier quoted context omitted.

> the other refuses to implement standards without caring about the rest of the ecosystem There is standard, and standard as previously Chrome only feature that Firefox felt pressured to implement and was then a posteriori made into a standard.

Pretty much every browser except Safari supports WebGL2

The WebKit commit is over 8 months old already: "Enable WebGL2 by default", Sep 14, 2020 – from https://trac.webkit.org/changeset/267027/webkit

CanIUse reports that it's only available in Safari Technology Preview for now, which is a macOS program: https://www.caniuse.com/webgl2

With WWDC 2021 only ~9 days away, one can hope that they'll announce its support on all platforms in the next major release. If it was already "good enough" last September…

Re: Safari tries to fill username

#376

Post by mannerheim »

thamer wrote: post #375
mannerheim wrote: post #365

Earlier quoted context omitted.

Pretty much every browser except Safari supports WebGL2

The WebKit commit is over 8 months old already: "Enable WebGL2 by default", Sep 14, 2020 – from https://trac.webkit.org/changeset/267027/webkit CanIUse reports that it's only available in Safari Technology Preview for now, which is a macOS program: https://www.caniuse.com/webgl2 With WWDC 2021 only ~9 days away, one can hope that they'll announce its support on all platforms in the next major release. If it was alrea…

I was aware it was in Safari Technology Preview, but I wouldn't really count a feature in a beta release as being available. And who knows when it will be available on iOS.

Re: Safari tries to fill username

#377

Post by bradknowles »

kstrauser wrote: post #340
deergomoo wrote: post #268

Earlier quoted context omitted.

I am currently arguing with the bargain-basement pentesters one of our clients hired. They are claiming the system we built is vulnerable because, and I quote, “any credentials sent over HTTPS are transmitted in plain text until they leave the user’s local network”. Not sure how exactly they think HTTPS works, but five minutes on Wikipedia could debunk that one. They also flagged up that users can access JavaScript a…

"Look, I'm going to be honest with you: your pentesters are morons. They're grossly incompetent and should be embarrassed. I can give you a list of qualified alternatives you might want to choose from, and not just to test the work I've done for you, but for all your other projects too. Seriously, their advice is just awful and you really need to switch." This isn't the time to tread lightly, but to go scorched earth…

The key here is to make this a do-or-die conversation. Tell the customer the truth, and then tell them you’re not going to work for them any more if they keep the other morons on the payroll — you’re not going to risk your reputation and your business on being associated with that other company.

“I’m sorry if this means we can’t do business any more, but this situation has gotten so severe, that I just have to tell you the unvarnished truth, and ….”

Re: Safari tries to fill username

#378

Post by bradknowles »

emodendroket wrote: post #276
jolux wrote: post #261

Earlier quoted context omitted.

> Oh, and that password? Not case sensitive. What, you expect them to make a case-sensitive version of NTFS just to store your password??

NTFS is case-sensitive.

It is case-preserving, but not case-sensitive.

So, it will show you what was entered and make you think it’s case-sensitive, but then when you go to do the comparison, it actually ignores case.

The stupid thing is that MacOS was also case-preserving but not case-sensitive for a long time.

Re: Safari tries to fill username

#379

Post by scintill76 »

deergomoo wrote: post #318
dec0dedab0de wrote: post #293

Earlier quoted context omitted.

wait, so what do they suggest you do instead?

For the HTTPS thing, they’re suggesting client-side encryption. Which, to me, seems to be a combination of no real benefit and opens a window to introduce vulnerabilities if we get anything wrong. Interestingly, I checked a few big sites, and while Google doesn’t, Facebook and Amazon both use client-side encryption. Is it just to provide some extra protection for pwned users who have trusted bad certs? I’m no securit…

If you're stuck following their recommendations, you could try to sniff Accept headers or user agent or something to "block access" to JS/CSS but still allow the browser to load them in your page. Might risk breaking the app though.

Re: Safari tries to fill username

#380

Post by slver »

quotemstr wrote: post #370
slver wrote: post #363

Earlier quoted context omitted.

I thought I told you to sit down and read the reports. Why are you so insistent on speculating based on no information instead of actually reading the specific cases described there? One app is a kiosk that keeps saving people's passwords and autofilling them for the next user. Another app has its own address dropdown but Chrome hides it and keeps autofilling the same address over and over making the app useless. A t…

> Don't be a know-it-all. Go actually learn something. Try again, but with less personal invective. You're listing a few bad things that happen because Chrome ignores autocomplete="off", but you're not listing all the bad things that would happen if Chrome didn't ignore autocomplete="off" --- namely, users using weaker passwords and getting compromised more. Sorry, all the things you mention sound like minor annoyanc…

Not surprisingly facts made you dig your heels deeper.
Post reply on HN