Substack's UI and 1Password temporarily cost me $2k • Hacker News Board

Re: Substack's UI and 1Password temporarily cost me $2k

#81

Post by SPBS » Tue, Mar 23, 2021, 2:16 AM UTC

TechBro8615 wrote: post #20

Yikes. I love my password manager, but I decided when I got it that I was never going to use the browser extensions. Putting your password manager anywhere near your web browser just seems like insanity to me (all the exploit write-ups I recall about password managers were related to browser extensions and sandbox escapes). This seems like another reason. It's not worth it. Keep the password manager in its own app an…

I've never encountered any autofill instance where the effects of autofill wasn't immediately apparent (usually it's just the username and password). Having a special hidden fields in your form seems like a Bad Idea, but what is worrying is that there is nothing stopping more devs from implementing something like this. The only reason why we don't see it more often is probably because it takes more effort to make a "smart" form like this.

Re: Substack's UI and 1Password temporarily cost me $2k

#82

Post by skeoh » Tue, Mar 23, 2021, 2:18 AM UTC

bachmeier wrote: post #11

petulla wrote: post #3

Seems more accurate to say that 1Password not Substack did this? Also headline is not true?

I'd say the Substack UI is messed up if (a) there's a hidden input box that automatically changes the selection, even though the user cannot manually enter information there, and (b) there's no confirmation screen to confirm everything is correct. It shouldn't matter that a password manager exposed the problem.

The use of the word "hidden" in the article is misleading. The field is visible and editable by the user -- it is just styled in a way that does not make it clear it is an editable field. There is a GIF in the article showing the author changing this field value manually.

Re: Substack's UI and 1Password temporarily cost me $2k

#83

Post by MattGaiser » Tue, Mar 23, 2021, 2:18 AM UTC

thanksforfish wrote: post #38

MattGaiser wrote: post #10

Earlier quoted context omitted.

The testing burden is already enormous for things people want sites tested for.

Whats the solution for the busy engineer? Anyone know a Selenium plug in that let's you run with browser extensions or something? There's too many popular extensions to test manually.

This is probably so far down the list that I would be interested to hear of any kind of testing of extensions at all for non-extension companies.

Re: Substack's UI and 1Password temporarily cost me $2k

#84

Post by dang » Tue, Mar 23, 2021, 2:26 AM UTC

I've put "temporarily" in the title because the post now says the money has been refunded. The article is worth leaving up because, unlike the typical riler-upper, it touches on a phenomenon which is interesting in its own right. But I don't think it's fair to leave up a title that implies that there's an uncorrected injustice to get angry about. If anyone has a better solution, we can do that instead.

Re: Substack's UI and 1Password temporarily cost me $2k

#85

Post by bombcar » Tue, Mar 23, 2021, 2:28 AM UTC

chrismorgan wrote: post #77

onelovetwo wrote: post #65

Earlier quoted context omitted.

Or 1Pass does a little bit more smart in checking before randomly entering text? It wouldn't be difficult to catch this

The problem is that all of these autofillers are already way too complex, because almost no one uses the optimal markup (adding the attribute autocomplete="cc-exp-year", in this case)—almost no one has even heard of the proper autocomplete markup here (I remember being in a conference room with two or three hundred other web developers a couple of years back, and the speaker asked who knew about autocomplete="new-pas…

Where are these various autocompletes detailed?

Re: Substack's UI and 1Password temporarily cost me $2k

#86

Post by dang » Tue, Mar 23, 2021, 2:29 AM UTC

petulla wrote: post #3

Seems more accurate to say that 1Password not Substack did this? Also headline is not true?

We've added "temporarily" to the title to make it true again, or at least as close to true as it started out.

Re: Substack's UI and 1Password temporarily cost me $2k

#87

Post by sellyme » Tue, Mar 23, 2021, 2:29 AM UTC

CGamesPlay wrote: post #5

petulla wrote: post #3

Seems more accurate to say that 1Password not Substack did this? Also headline is not true?

Yeah it seems pretty clear that this was a 1Password flaw and didn't really have anything to do with Substack's UI. And yes, the first paragraph notes that no money was spent, so not really sure why multiple people have downvoted your comment.

> Yeah it seems pretty clear that this was a 1Password flaw and didn't really have anything to do with Substack's UI

The UI is styled to make it so that a form input is completely indistinguishable from surrounding text, to such an extent that even people who know it's a form input in this thread have incorrectly assumed that it's not manually editable.

I can't comprehend how anyone could defend deliberately misleading UI design in a form that is asking for your credit card information. This is a problem with Substack. 1Password can definitely do better to guard against it happening, but the only reason it did happen is because Substack actively tried to hide important information from users in a payment screen.

Re: Substack's UI and 1Password temporarily cost me $2k

#88

Post by [deleted] » Tue, Mar 23, 2021, 2:36 AM UTC

tedyoung wrote: post #2

I wish sites would test their forms with popular password management systems. This kind of thing happens all too often (thought perhaps not with such a high cost). Why not make it easy for people who auto-fill with these programs -- don't fight them. (And I won't get into sites that won't let you paste passwords into their forms.)

[deleted]

Re: Substack's UI and 1Password temporarily cost me $2k

#89

Post by throwanem » Tue, Mar 23, 2021, 2:36 AM UTC

bombcar wrote: post #85

chrismorgan wrote: post #77

Earlier quoted context omitted.

The problem is that all of these autofillers are already way too complex, because almost no one uses the optimal markup (adding the attribute autocomplete="cc-exp-year", in this case)—almost no one has even heard of the proper autocomplete markup here (I remember being in a conference room with two or three hundred other web developers a couple of years back, and the speaker asked who knew about autocomplete="new-pas…

Where are these various autocompletes detailed?

MDN has a good list: https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes...

Re: Substack's UI and 1Password temporarily cost me $2k

#90

Post by throwanem » Tue, Mar 23, 2021, 2:40 AM UTC

r00fus wrote: post #68

cortesoft wrote: post #61

Earlier quoted context omitted.

You don't get cash back bonuses with a pre-paid card. In fact, they cost money. I am not going to give up saving 3% on everything I buy just to avoid this rare error that was easily corrected for no lost money.

Where are you getting 3% back on all transactions?

Presumably on a credit card, which would also have more robust chargeback rights than debit cards typically do. Between that and the likely relatively high value of a customer qualifying for 3% cash back on every transaction, I doubt it'd be more than a minor inconvenience to have the transaction reversed, even if the acquirer declined to refund it - which didn't happen here, in any case.