381–390 of 397 posts
Earlier quoted context omitted.
Jesus holy Apple pie! ASCII only in 2023 seems positivity antique. And this from a supposed tech frontrunner! Wth...
In what platforms is it not possible to input 7-bit ASCII characters 020 -- 073 (octal)? In what platforms is it not possible to input various Unicode or emoji characters, whether at all or reliably?
Ctrl+8 will paste in the latest item on my clipboard, and honestly it has been so helpful that I'm quite elated.
I recommend others running a userscript for themselves, this extension is awesome, but it's something that can be broken again and again. not really a permanent solution
Earlier quoted context omitted.
In what platforms is it not possible to input 7-bit ASCII characters 020 -- 073 (octal)? In what platforms is it not possible to input various Unicode or emoji characters, whether at all or reliably?
Try setting up your Linux desktop/laptop with a Cyrillic language keyboard only, and then try typing in your ASCII login password.
Do you have any direct experience with this?
My point is that 7-bit ASCII underlies virtually all other keyboard / character encodings. Among the few cases where it doesn't (e.g., IBM mainframe EBCDIC, independent of ASCII), the principle encoding remains the Latin alphabet, and can readily be converted using standard system utilities.
By disabling user input the application security actually gets worse. Users that can’t copy e.g. passwords will use less complex passwords to overcome the trouble of typing in their initially good passwords. But also user experience is degrading when applications enforce complex input and users generate that input like a chad as they should. But now they cannot paste…
I generally agree that you should let the user use the facilities they're used to, but if you have a habit of copying and pasting credentials you'll be more vulnerable to phishing. Firefox and Chrome's built-in password management tools would never accidentally enter your credentials on a lookalike site, but you very well might.
Earlier quoted context omitted.
Even worse, some will simply arbitrarily silently truncate the password. But not everywhere! The sign up page might silently truncate and then the actual login page might not.
Wow. That would be a wonderful game of treasure hunt. Fortunately I've not come across that so far :D
To work around this I usually drag and drop text pasted into the URL field or somewhere, on my Mac at least. Can I just say though that disabling paste, apparently in the name of security, is the dumbest shit I have ever encountered, right in front of ultra short timeouts everywhere. If only I could meet the people who make these decisions in person...
> right in front of ultra short timeouts everywhere > If only I could meet the people who make these decisions in person... For what it's worth, I was once forced to implement a half hour auto-logout on a website that could hardly be considered as containing sensitive data because an external pentest firm flagged the lack of a short timeout as an issue. The only way we could show clients a passing pentest was to comp…
Earlier quoted context omitted.
Here was a dumb one from me the other day. - I had to use login.gov - My password manager had a saved login for it, I didn’t remember it, but it worked - Then the site asked me for an authenticator app code. I checked my authenticator apps and there was nothing there for login.gov. - There’s a login another way button so I click that and the other way is use the authenticator app! - I click what if I can’t get my cod…
I would guess that the 24 hour delay is to allow the real owner of the account a change to cancel the delete if someone tries to mess with their account. That said, you're right. This is really weird.
Earlier quoted context omitted.
> Even worse, there are some that restrict what kind of special character you can use Even worse , there are some that restrict special characters, but don't tell you which! Now you've got to go trial and error to find out which of the special characters in your password is not acceptable to that precious §("/$& website!
The worst I've seen have uncommunicated password length maximums—but don't error when you exceed them. Instead, they just truncate your password, but only on creation. When authenticating, they don't truncate, so your password you just made with a password manager is "wrong". Spotify did/does this. Made canceling my free trial really tricky, because I needed to log in again to do so.
I added this check to my "why the fuck this password did not work" list of idiocies produced by incompetent developers
So you had to write down your passwords, map an index (1, 2, 3, ...) to each character and check the ones that match.
But it was not all! You had a time limit!
These idiots disabled it for some time and then apparently reenabled it again.
I wonder, seriously, which education the inventor had and to which point his team was saying yes to everything.
Right up there with hijacking Ctrl-F.
Stripe’s API documentation does this and it gives me the shits, because it seizes up my M2 MacBook Pro for several seconds. I can’t believe that it’s 2024, and I can’t simply grep some documentation.