Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Safari tries to fill username

github.com

Post reply on HN
Print view View original

81–90 of 393 posts

Re: Safari tries to fill username

#81

Post by donatzsky »

thaumasiotes wrote: post #70
izacus wrote: post #62

Earlier quoted context omitted.

Oh man, enterprise "security" firms used by banks and other old behemoths are a cancer for users. If you want your website to actively abuse users (especially one with special needs and pretty much anyone that doesn't fit into an "made up average person mold") get those people on board and listen to the dumb things they say. I still can't believe that whole business managed to interpret 2FA for whole EU as "you MUST…

> I still can't believe that whole business managed to interpret 2FA for whole EU as "you MUST use SMS for 2FA!". Weeeeeelll... I'm familiar with two (2) common kinds of "2FA" implementations. TOTP and SMS. Of those two, only SMS is actually a second factor, albeit not a particularly secure one. TOTP is fundamentally a password, and two passwords are no different than one password.

TOTP is no more a password than whatever one-time code you'd get by SMS. In fact, TOTP is arguably more secure, since it isn't nearly as vulnerable to hijacking as SMS is.

Re: Safari tries to fill username

#82

Post by rd11235 »

samjmck wrote: post #60

It _wants_ to autofill, but it doesn't without the user actually confirming the autofill. Pretty important distinction to make I think

Agree. Current title is inaccurate and click baity.

Also, the confirmation requires authentication (at least by default, unsure if this can be changed).

Re: Safari tries to fill username

#83

Post by thaumasiotes »

nl wrote: post #79
thaumasiotes wrote: post #70

Earlier quoted context omitted.

> I still can't believe that whole business managed to interpret 2FA for whole EU as "you MUST use SMS for 2FA!". Weeeeeelll... I'm familiar with two (2) common kinds of "2FA" implementations. TOTP and SMS. Of those two, only SMS is actually a second factor, albeit not a particularly secure one. TOTP is fundamentally a password, and two passwords are no different than one password.

TOTP is a second factor. The hash seed that generates a password is connected to the device.

The seed is all you need. The device is unnecessary.

Re: Safari tries to fill username

#85

Post by thaumasiotes »

donatzsky wrote: post #81
thaumasiotes wrote: post #70

Earlier quoted context omitted.

> I still can't believe that whole business managed to interpret 2FA for whole EU as "you MUST use SMS for 2FA!". Weeeeeelll... I'm familiar with two (2) common kinds of "2FA" implementations. TOTP and SMS. Of those two, only SMS is actually a second factor, albeit not a particularly secure one. TOTP is fundamentally a password, and two passwords are no different than one password.

TOTP is no more a password than whatever one-time code you'd get by SMS. In fact, TOTP is arguably more secure, since it isn't nearly as vulnerable to hijacking as SMS is.

> In fact, TOTP is arguably more secure, since it isn't nearly as vulnerable to hijacking as SMS is.

Indeed, this is an argument you can reasonably make.

> TOTP is no more a password than whatever one-time code you'd get by SMS.

But this isn't; this is just a blatant lie.

Re: Safari tries to fill username

#86

Post by lucideer »

thaumasiotes wrote: post #70
izacus wrote: post #62

Earlier quoted context omitted.

Oh man, enterprise "security" firms used by banks and other old behemoths are a cancer for users. If you want your website to actively abuse users (especially one with special needs and pretty much anyone that doesn't fit into an "made up average person mold") get those people on board and listen to the dumb things they say. I still can't believe that whole business managed to interpret 2FA for whole EU as "you MUST…

> I still can't believe that whole business managed to interpret 2FA for whole EU as "you MUST use SMS for 2FA!". Weeeeeelll... I'm familiar with two (2) common kinds of "2FA" implementations. TOTP and SMS. Of those two, only SMS is actually a second factor, albeit not a particularly secure one. TOTP is fundamentally a password, and two passwords are no different than one password.

> TOTP is fundamentally a password

I see this view a lot. It's wrong. TOTP is fundamentally different to a password, as the stored "password" (by which I presume you mean the key) is never transmitted anywhere.

TOTP in fact has one property that makes it potentially* the most secure of all 2FA methods: it can be used airgapped. As the credential you type into the 2FA form is not the saved secret.

* I say "potentially" because the relative inconvenience + human factors conspire to make it less secure than e.g. U2F in most cases. But assuming hypothetical perfect conditions, there would be nothing more secure than TOTP for 2FA.

Re: Safari tries to fill username

#87

Post by thaumasiotes »

lucideer wrote: post #86
thaumasiotes wrote: post #70

Earlier quoted context omitted.

> I still can't believe that whole business managed to interpret 2FA for whole EU as "you MUST use SMS for 2FA!". Weeeeeelll... I'm familiar with two (2) common kinds of "2FA" implementations. TOTP and SMS. Of those two, only SMS is actually a second factor, albeit not a particularly secure one. TOTP is fundamentally a password, and two passwords are no different than one password.

> TOTP is fundamentally a password I see this view a lot. It's wrong. TOTP is fundamentally different to a password, as the stored "password" (by which I presume you mean the key) is never transmitted anywhere. TOTP in fact has one property that makes it potentially* the most secure of all 2FA methods: it can be used airgapped. As the credential you type into the 2FA form is not the saved secret. * I say "potentially…

> TOTP is fundamentally different to a password, as the stored "password" (by which I presume you mean the key) is never transmitted anywhere.

Are you familiar with SRP?

TOTP has all of the properties of passwords, and no properties that passwords don't have. That makes it... a password.

Re: Safari tries to fill username

#88

Post by jimktrains2 »

thaumasiotes wrote: post #80
wffurr wrote: post #71

Earlier quoted context omitted.

Doesn’t answering a TOTP challenge prove that you “have” the HMAC shared key that seeds the code generator?

Yes, that shared key is a password, a piece of knowledge known in common between you and them.

A password is something you're supposed to "know", i.e. something in your head.

A second factor is something you have, i.e. your phone, a hardware token, or access to a shared secret you don't store in your head.

Password managers kind of mangle the idea and turn the password from something you know to something you have.

Re: Safari tries to fill username

#89

Post by pornel »

There was probably an important website somewhere that had a login page with a shitty markup, and Safari users complained that autofill "doesn't work" there. Garbage markup got a garbage workaround.

Re: Safari tries to fill username

#90

Post by kikoreis »

lmilcin wrote: post #76
airza wrote: post #43

Earlier quoted context omitted.

The nuance here is that brain-damaged appsec pentesters reported this as a vulnerability for years, and so tons of websites followed that advice and dutifully disabled the functionality. But autocomplete has advantages: it lets users easily specify long, random, per-site passwords without ever having to worry about that. And when they can't do that, a pretty large percentage of them just give up and write the passwor…

Autocomplete has one huge, glaring disadvantage: the passwords are stored on your computer, in reversible form.

Yes, but let's be fair, it's a galaxy better than writing it on a post-it or password booklet, and still way better than using a memorable passphrase which will get reused and then leaked.

Besides, you can encrypt the local storage with a master password (and if you accept online as a requirement, you could even add 2FA to that).

Post reply on HN