Substack's UI and 1Password temporarily cost me $2k

Post by edaemon » Tue, Mar 23, 2021, 2:44 AM UTC

mbreese wrote: post #39

revskill wrote: post #28

What's the point of hidden input there ? A bug ? A feature ?

It’s not “hidden” in the HTML form sense. It’s an input that is not styled as an obvious input field. The idea here is that if you want to, you can give the author more money as a “founding member”. You can the set the amount you’d like to give. It is visible to the user, but it isn’t obvious that this is an adjustable value at all (at least on mobile). There are a number of UX issues at play here... but a poorly sty…

Post by skeoh » Tue, Mar 23, 2021, 2:51 AM UTC

edaemon wrote: post #91

skeoh wrote: post #82

Earlier quoted context omitted.

The use of the word "hidden" in the article is misleading. The field is visible and editable by the user -- it is just styled in a way that does not make it clear it is an editable field. There is a GIF in the article showing the author changing this field value manually.

It's not misleading at all; it's an input with the type set to "hidden". The field doesn't become visible until you select the radio button for that subscription level.

Post by cortesoft » Tue, Mar 23, 2021, 2:52 AM UTC

r00fus wrote: post #68

cortesoft wrote: post #61

Earlier quoted context omitted.

You don't get cash back bonuses with a pre-paid card. In fact, they cost money. I am not going to give up saving 3% on everything I buy just to avoid this rare error that was easily corrected for no lost money.

Where are you getting 3% back on all transactions?

Post by Cldfire » Tue, Mar 23, 2021, 2:55 AM UTC

hombre_fatal wrote: post #52

TechBro8615 wrote: post #20

Yikes. I love my password manager, but I decided when I got it that I was never going to use the browser extensions. Putting your password manager anywhere near your web browser just seems like insanity to me (all the exploit write-ups I recall about password managers were related to browser extensions and sandbox escapes). This seems like another reason. It's not worth it. Keep the password manager in its own app an…

Password managers aren't nearly intelligent enough to be used without copy and paste for sensitive forms. One example is how almost every password manager including the built-in one in most browsers will assume that if there's a type="password" field, then the previous sibling field must be the username. Sometimes they'll even pick a field far away in the DOM like your chatbox input to autofill with the username. So…

Post by asiachick » Tue, Mar 23, 2021, 3:08 AM UTC

Cldfire wrote: post #98

hombre_fatal wrote: post #52

Earlier quoted context omitted.

Password managers aren't nearly intelligent enough to be used without copy and paste for sensitive forms. One example is how almost every password manager including the built-in one in most browsers will assume that if there's a type="password" field, then the previous sibling field must be the username. Sometimes they'll even pick a field far away in the DOM like your chatbox input to autofill with the username. So…

> One example is how almost every password manager including the built-in one in most browsers will assume that if there's a type="password" field, then the previous sibling field must be the username. Sometimes they'll even pick a field far away in the DOM like your chatbox input to autofill with the username. Note that this behavior is defined as part of the `autocomplete` standard. https://html.spec.whatwg.org/mul…