Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Somebody implemented something I wrote a blog about

news.ycombinator.com

Post reply on HN
Print view View original

61–70 of 253 posts

Re: Tell HN: Somebody implemented something I wrote a blog about

#61

Post by thallavajhula »

spiffytech wrote: post #28

Years back, every web browser's built-in password manager locked up the page when submitting a login form, waiting for the user to answer "do you want to save this password?" before proceeding. I thought that was silly: how do I know if I want to save the password before I've seen whether it's correct? Which I can't see until the form is submitted. At the time I was using Opera, so I wrote in to their customer suppor…

Opera was the most innovative web browser ever. They brought so many new things to the world of web browsing. Tabbed-browsing, mouse gestures, colored tabs, browser themes, in-built security integration with anti-virus software, an extensible browser - so many wonderful innovative features. It was a paid software initially, but then they made it free for everyone. I used to use it as my default browser, maybe 13-15 years ago.

Re: Tell HN: Somebody implemented something I wrote a blog about

#62

Post by dspillett »

NiagaraThistle wrote: post #48
tra3 wrote: post #2

That’s awesome. I was expecting a lament on how an amazing startup idea was stolen and monetized by someone else. Glad I’m wrong and the world is a little bit better.

Same here. Came to say the same and to explain how i publicly share all my 'great' ideas publicly even though so many friends think I'm nuts in case someone 'steals it' and makes a successful startup from my idea. My answer: "Great for them. At least they had the determination and focus to follow through with bringing the idea to fruition when I couldn't."

Same. I'll often share relevant ideas in comments here and elsewhere in the hope that I inspire someone to go implement something I might like but will never find the time+organisation to get around to creating!

Re: Tell HN: Somebody implemented something I wrote a blog about

#63

Post by EGreg »

I agree but there is an even more serious security feature almost all 2FA misses:

Telling the user what action they are authorizing by reading back the numbers.

That “bank rep” on the phone? They are probably trying to log into your account, or withdraw cash, not verify that you are the right person to send the refund back to.

It would save a lot of problems.

Also you should be getting an alert on all your devices whenever transactions over X amount per Y time occur, and you should have an opportunity to reverse them for 24 hours (even for debit cards). Also you should be able to make windows during which time it would be longer than 24 hours, such as a Jewish holiday or when out of range. This wouldn’t apply to recurring transactions.

Re: Tell HN: Somebody implemented something I wrote a blog about

#64

Post by malshe »

layer8 wrote: post #47
spiffytech wrote: post #28

Years back, every web browser's built-in password manager locked up the page when submitting a login form, waiting for the user to answer "do you want to save this password?" before proceeding. I thought that was silly: how do I know if I want to save the password before I've seen whether it's correct? Which I can't see until the form is submitted. At the time I was using Opera, so I wrote in to their customer suppor…

This still sometimes happens on iOS Safari. I don’t know what is different about the pages where it happens, but it’s annoying.

Even MacOS Safari does this. I don't know whether the latest update fixed it though.

Re: Tell HN: Somebody implemented something I wrote a blog about

#65

Post by lupire »

bilekas wrote: post #59

We implemented something that avoids the original articles, 2FA notification. After your password is approved before 2FA you get an email. So even if someone is somehow using the right 2FA you are aware. Our thinking was the mosly likely outcome was someone would hit 2FA, not have the code and so close the request without even entering a bad code. Apart from that though, it is always nice to get recognition for the s…

But email can be delayed for hours or days.

Re: Tell HN: Somebody implemented something I wrote a blog about

#66

Post by ncmncm »

dhosek wrote: post #49
NiagaraThistle wrote: post #48

Earlier quoted context omitted.

Same here. Came to say the same and to explain how i publicly share all my 'great' ideas publicly even though so many friends think I'm nuts in case someone 'steals it' and makes a successful startup from my idea. My answer: "Great for them. At least they had the determination and focus to follow through with bringing the idea to fruition when I couldn't."

People tend to overvalue ideas. I see this all the time in writing where people are worried someone will steal their great idea for a story. The truth of the matter is that it’s unlikely that you’ve come up with something truly new and in any event, ideas tend to breed and multiply. I will never write all the stories and novels that I have jotted down in my notebook before I die and there are more every day.

If an idea is any good, you generally have to fight tooth and nail to get anybody to listen to it, and put in a hundred times that to get anybody to understand it, and that again to act on it.

If you don't directly control how that happens they will implement it fundamentally wrongly.

But after it is finally implemented more or less correctly, everyone will agree that the idea was trivial and obvious, and they had already thought of it themselves, in exactly the form where they first encountered it, even if that is actually not quite right.

Re: Tell HN: Somebody implemented something I wrote a blog about

#67

Post by abfan1127 »

thallavajhula wrote: post #61
spiffytech wrote: post #28

Years back, every web browser's built-in password manager locked up the page when submitting a login form, waiting for the user to answer "do you want to save this password?" before proceeding. I thought that was silly: how do I know if I want to save the password before I've seen whether it's correct? Which I can't see until the form is submitted. At the time I was using Opera, so I wrote in to their customer suppor…

Opera was the most innovative web browser ever. They brought so many new things to the world of web browsing. Tabbed-browsing, mouse gestures, colored tabs, browser themes, in-built security integration with anti-virus software, an extensible browser - so many wonderful innovative features. It was a paid software initially, but then they made it free for everyone. I used to use it as my default browser, maybe 13-15 y…

its my default browser now. It still great!

Re: Tell HN: Somebody implemented something I wrote a blog about

#68

Post by flippinbits »

Actually, PSD2 SCA (Strong Customer Authentication) talks about requiring 2 different elements (out of knowledge, possession, inference) for authentication, while also requiring that information on which one was wrong when authentication failed, to not be disclosed. This directive needs to be implemented by all payment processors in EU (I am not an expert on this).

We have implemented such a system at a company I worked at, where we also took into account the credential stuffing aspect as you talk about it. It is quite challenging to ensure no information leaks (in content and in other request parameters, including response times) when users transition from the partially (un)authenticated state (username + password) towards 2FA. I have to say that security aspect is noticeable in a significant drop in credential stuffing attacks volume, but usability wise I see why this is not a popular approach :). I personally hate it, especially when 2FA that is used is TOTP.

Re: Tell HN: Somebody implemented something I wrote a blog about

#69

Post by KolmogorovComp »

ezekg wrote: post #25

Related: I think it's surprising how many services leak whether or not a password is correct. E.g. bad password => error, good password => 2FA prompt. You should verify a user's second factor before password.

Same thing goes for email address when registering. Correct email => “already in use” is still frequent, although some websites (such as github) have changed it to “incorrect or already in use email”

Re: Tell HN: Somebody implemented something I wrote a blog about

#70

Post by capableweb »

abfan1127 wrote: post #67
thallavajhula wrote: post #61

Earlier quoted context omitted.

Opera was the most innovative web browser ever. They brought so many new things to the world of web browsing. Tabbed-browsing, mouse gestures, colored tabs, browser themes, in-built security integration with anti-virus software, an extensible browser - so many wonderful innovative features. It was a paid software initially, but then they made it free for everyone. I used to use it as my default browser, maybe 13-15 y…

its my default browser now. It still great!

Well, I used to love Opera as well, it was my first "serious" browser as I became a netizen. But now I wouldn't even dare to try it as it's owned by a consortium of Chinese investors, rather than a Norwegian company.
Post reply on HN