Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Don’t Get Clever with Login Forms

bradfrost.com

Post reply on HN
Print view View original

471–480 of 520 posts

Re: Don’t Get Clever with Login Forms

#471

Post by darkhorn »

FabHK wrote: post #126
MichaelDickens wrote: post #106

Earlier quoted context omitted.

It's actually even worse than that: they keys on the virtual keyboard are displayed in a random order instead of QWERTY.

Well, that's better though. So even if there's a key logger and mouse click recorder on your machine, one cannot recover your password. Though, if your machine is that compromised, might as well have a screen recorder, too. Though that would create more outgoing traffic.

This means that they don't use 2FA. In Turkey 2FA is mandatory for all banks, via SMS or app on the phone.

Re: Don’t Get Clever with Login Forms

#472

Post by dkersten »

smadge wrote: post #453
baddox wrote: post #450

Earlier quoted context omitted.

Hmm, what about upvoting or liking a post? Or do you consider an AJAX POST request a “form?” There are also some more obvious smaller examples, like expanding/collapsing an accordion menu.

You could implement an upvote or like as a hyperlink or a form, then progressively enhance that feature to not initiate a full page reload (iirc this is how HN implements upvotes). Similarly expanding or collapsing an accordion menu could be a hyperlink which by default does request the additional content but which can be progressively enhanced to provide that feature with JavaScript for user agents that support it.…

It makes some sense to have an upvote be a form that posts somewhere and the response of which is a redirect (maybe a 307?) back to the page you’re on and then the progressive JavaScript enhancement would be to perform the request asynchronously instead of redirecting.

It makes sense because adding an upvote is the same as adding other form data to a database semantically so really should be treated the same way.

Re: Don’t Get Clever with Login Forms

#473

Post by chrisseaton »

Al-Khwarizmi wrote: post #464

Tip from a non-native English speaker: if you want your website to be more friendly to an international audience, don't use the terms "sign in" and "sign up", use more distinct terms (like "login" and "register") instead. Phrasal verbs, in general, are difficult to speakers of languages that don't have them, especially when the same verb has different meanings depending on the added preposition. Someone with a basic/…

But log in is also a phrasal verb...

Re: Don’t Get Clever with Login Forms

#474

Post by geofft »

nojvek wrote: post #397
geofft wrote: post #355

Earlier quoted context omitted.

The trick is to install a password manager browser extension, not to use a password manager that operates as an isolated app / CLI tool / website / etc. Then you unlock it once at the beginning of your session (or whatever frequency you feel like) and it will fill in passwords for you when you click, without having to copy/paste them. It's about as easy as external login / login with Google. (inb4 "but password manag…

Yes but when you’re constantly switching devices and machines. It’s a pain Most password managers don’t do jack inside a native app (for good security reasons - thank you Apple) I don’t want to go through 5 mins of clicking and pasting on my phone. A number of services force you to change passwords every couple of months. They save (may be hash) the old passwords so you can’t use them. How many goddamn passwords is o…

> Most password managers don’t do jack inside a native app (for good security reasons - thank you Apple)

This isn't true on iOS 12; there's a pretty good OS-wide password manager API. (And older versions of iOS don't get security updates so your device is pretty easy to compromise if you're not upgrading.) It securely pops up the password manager similar to popping up a share screen, so no copying and pasting is involved.

> A number of services force you to change passwords every couple of months. They save (may be hash) the old passwords so you can’t use them. How many goddamn passwords is one supposed to remember?

One. You put the changed passwords in your password manager, too.

Re: Don’t Get Clever with Login Forms

#475

Post by geofft »

dumpsterdiver wrote: post #382
tialaramex wrote: post #360

Earlier quoted context omitted.

Having auto-fill may be rather dangerous even if your password manager extension has no bugs whatsoever. I would not recommend this configuration. Having one touch form fill for credentials is good enough. It adds one touch to every intended login, but deletes the risk of credentials being captured when you weren't actually even trying to log in.

Regarding auto-fill, I second this. Password managers are great, but I would go so far as to advise against using password manager browser extensions entirely. You're adding several more vectors to be compromised, and imo the risk is not worth it. Navigate to the site, open the password manager, copy and paste the username and password into their respective fields. Yes, it's less convenient, but as we know convenienc…

> Navigate to the site, open the password manager, copy and paste the username and password into their respective fields.

This leaves you vulnerable to (at least) two attacks:

1) Phishing. The password manager extension will refuse to send the password to the wrong site; it can't be fooled when tired the same way you can be fooled when tired.

2) The password stays around in your clipboard. There's a general risk of accidentally pasting it (e.g. to the next site you log into). There's a specific risk of sites that capture activity on unsubmitted form fields, which is becoming way too common.

You should decide for yourself how you weigh these risks, but I'm a pretty paranoid person (e.g., I have a Chromebook in a corner of my room which I use as an SSH / web client for certain high-security sites like my domain registration and maintaining certain servers) and my conclusion is that the risk of phishing and mispastes is high and the risk of my particular password manager extension having serious bugs is much lower.

> Yes, it's less convenient, but as we know convenience is the bane of security.

I'll be honest, I don't know that. Security keys are more convenient than SMS-based 2FA, and significantly more secure. Signal is more convenient than PGP, and (depending on threat model) more secure in real-world use. Doing string processing in Python is way more convenient than doing it in C, and way more secure.

"It's annoying, therefore it must be secure" is a fallacy. Sure, there's some correlation, but it's not a perfect correlation.

Re: Don’t Get Clever with Login Forms

#476

Post by bookofjoe »

etatoby wrote: post #415
bookofjoe wrote: post #396

Earlier quoted context omitted.

>I also really like the "go to this website on your computer and enter this code" for logging in to Apple TV, Chromecast, etc so you aren't typing a 30 character password on a TV remote. I hate this with a passion. I'm all comfy in my chair, ready to watch something, and I get the message that I have to get up and go to my computer and do stuff when all I want to do is watch TV. So I watch something else that doesn't…

Have you considered using your smartphone, which is right next to you and already configured with your email and a web browser? That was probably the intended use case anyways.

My smartphone is not right next to me unless I'm outside the house. It remains in one place in my home (on my desk). Diff'rent strokes.

Re: Don’t Get Clever with Login Forms

#477

Post by dsego »

Al-Khwarizmi wrote: post #464

Tip from a non-native English speaker: if you want your website to be more friendly to an international audience, don't use the terms "sign in" and "sign up", use more distinct terms (like "login" and "register") instead. Phrasal verbs, in general, are difficult to speakers of languages that don't have them, especially when the same verb has different meanings depending on the added preposition. Someone with a basic/…

Afaik, you "sign up" for something, like a newsletter, or health insurance. You sign into a hotel, ie leave your signature at the check-in (or sign-in) desk. Btw, also not a native speaker.

Re: Don’t Get Clever with Login Forms

#478

Post by gumoro »

chrisseaton wrote: post #473
Al-Khwarizmi wrote: post #464

Tip from a non-native English speaker: if you want your website to be more friendly to an international audience, don't use the terms "sign in" and "sign up", use more distinct terms (like "login" and "register") instead. Phrasal verbs, in general, are difficult to speakers of languages that don't have them, especially when the same verb has different meanings depending on the added preposition. Someone with a basic/…

But log in is also a phrasal verb...

which is close enough to "login", which is widely understood (I do have the same issue with "sign in" VS "sign up", I know the difference, but as a non-native speaker it also takes me a second, or sometimes one is more prominent than the other and I mistakenly click on it, etc).

But whatever, ("Sign in" or "Log in") alongside "Register" is clear enough. "Sign in" alongside "Sign up" is confusing. Thanks Al-Khwarizmi for bringing that up... or is it bring in ? ;)

Re: Don’t Get Clever with Login Forms

#479

Post by firexcy »

Can anyone explain to me the rationale for the recent trend to split the input of username and password into two steps? I noticed more and more services (including Outlook, iCloud, Evernote, etc.) have adopted such an annoying design, which makes no sense to me. I guess the purpose for doing so is to preempt user from typing a wrong/non-exist username so that server resources for checking unmatched credentials are saved and brutal force attacks are prevented? But do they justify all the hassle caused to daily users?

Re: Don’t Get Clever with Login Forms

#480

Post by photoguy112 »

ArrayList wrote: post #241
reaperducer wrote: post #75

Earlier quoted context omitted.

Citibank is bad, too. It uses some kind of JS trick to replace usernames and passwords with asterisks, and you end up with all kinds of invalid information stored in your password manager.

Citibank absolutely sucks for overall UX. Have they ever heard of input type="password"?

Chase beats Citybank - they ask for a case sensitive password but dont care about case sensitivity when entering your password.
Post reply on HN