Comment by greggman | Hacker News Reader

Comment by greggman | Hacker News Reader

> Exposing representation invariants In object-oriented programming, a representation invariant is a set of constraints that a concrete data type must uphold to correctly represent an abstract data type. Simply mapping a data structure to a UI would expose the invariant and put the burden of enforcing the invariant on users instead of the code. A typical example is having to enter a phone or part number in a specific format instead of the program handling any reasonable input. > Warning sign: Users required to enter data using a specific format.

This one drives me nuts. Soooooo many forms say "enter your phone number no spaces or dashes or parens" or cc number. Please just remove the dashes, spaces, parens when checking validation and maybe after submit. Don't force the user to have to do this. They might be copying and pasting

Also don't make some 4 field 16 digit custom form that ruins backspace behavior and makes it impossible to copy and paste. That also means don't limit the field to 16 characters. If a users pastes in "xxxx-yyyy-zzzz-wwww" and only get "xxxx-yyyy-zzzz-w" you're only going to frustrate them.

This is also an issue with many phone apps. Some you can't paste a number in. Try copying a number from Safari iOS into Google Hangouts Phone dialer. There's no paste option so I'm forced to write down the number on paper so I can manaully type it back in. Even the built in iOS phone dialer sucks. While you can paste you can't edit. So if you copy something off a webpage and because of the crappy smartphone copy/paste issues you get something like "dial:123-4556" there's no way to remove the "dial:" part. At best you have to paste into some other app that will let you edit, edit, then copy and paste again. Sheesh, does no one ever use this stuff?

> Try copying a number from Safari iOS into Google Hangouts Phone dialer. There's no paste option

The paste option is there, however it's very tricky to get it to appear. You have to hold your finger down over the space where the number appears, but sometimes you have to try it 5-10 times to get the paste option to actually appear. Before Google Voice shut off external integration and ruined it I had an app called Talkatone which worked with Google Voice, Hangouts has never been as good as that app.

That's why I think there should be an online resource with different types of UI elements, and their functional requirements. This way, when any developer feels the desire (or is forced to) reinvent the wheel, at least they can get a complete picture of all the requirements.

Another one is password restrictions: if I want to use a one-character password, that's my business. If I want to use my birthday as password, that's my business.

If the app developer is concerned about security in case an attacker gets hold of the raw database, there are better tools for that (i.e. proper salting and hashing)

Salting and hashing isn't going to help you much if you're prone to using one-character passwords. Unfortunately, people will use one-character passwords if they are allowed to, so systems should require strong passwords to protect users.

That's not to say there aren't problems with password restrictions, but they are mostly at the other end of the spectrum. For example, I have seen far too many systems requiring that passwords must be no longer than ten characters long, or only allowing a very small subset of characters.

> Salting and hashing isn't going to help you much if you're prone to using one-character passwords

Why not? OK I'm no cryptographer, so I'm probably talking out of my arse but why not store a random salt PER user, and the hash of (password + salt)? To an attacker, a one character password will be as hard to crack as a complex one.

An attacker would still be able to brute-force the password in a split-second.

Besides, if you're using the same one-character password for multiple systems, the password can easily be deduced on a system that only uses hashing (or a weak form of salting), and an attacker can use that password to access accounts on stronger systems.

You just try every character. A computer can do that in < 1 second.

> hard

A 1-char password can be guessed in as many attempts as the size of the allowed character set, and in half the guesses on average. Even less guesses are required on average if passwords aren't distributed uniformly and this distribution is known (i.e. from previously cracked password databases you know most users pick "e" for a password, so you start with that character and get into the accounts of 40% of all other users in a single guess).

More generally, the average number of attempts required to crack a password with a known length is 1/2 * charsetsize ^ length. So with alphanumeric case-sensitive 1-char passwords the number of attempts required on average is 31. That's not a lot.

The only thing that salt + hash does is make it possible to check the password without having to store the passwords on server; it only serves to protect user passwords after the password (hash) database has been stolen by attackers.

The only way to keep a semblance of security when user passwords are very short is to aggressively rate-limit password attempts, but in the case of 1 char passwords that doesn't help, you'd have to lock the user out after a single wrong password entry, and even then attackers would have a chance of 1/62 (26 lowercase letters, 26 uppercase letters and 10 numbers) chance of getting into your account.

Bravo.

I think what you mean is a pepper: https://en.wikipedia.org/wiki/Pepper_(cryptography)

At the very least, every site should clearly explain its password policy. e.g. you must have a letter, a number, no slashes, 8-40 characters, whatever.

As I write this, I am locked out of my 401(k) plan's website because it allows you to reset your password to an illegal string, which fails when you try to log back in. Crappy corporate UX boggles the mind.

I'm fine with a minimum length but adding some random characters to my password will only make it harder to remember my 20 character long passwords.

That's if you're allowed to use that many characters.

A disturbing number of sites (even banks) put limits on the size of a password which tend ot make me think they're storing it somewhere plaintext...

I'd go so far as to say "especially banks".

Banks, credit card companies, insurance companies, and other places like that are the only time I usually run into the "4-6 characters, no symbols" type restrictions.

> if I want to use a one-character password, that's my business

It's really not. Depending on the service, someone who guesses your weak password and compromises your account may very well be able to injure more people than just you.

But then he, knowing the all-complex-password he's forced to create, can also make those others miserable too. Just because he is known doesn't mean he can't broke everything.

So, the problem is with the service, not with his weak password. It's just a matter if someone will be easily / hardly / not at all blamed.

If the user isn't going to take the security of the app you built seriously, you the app developer has to.

It never looks bad for the user to get their data breached. It always looks bad and can do lasting damage to a company if an application suffers a breach.

I don't mind -- too much -- those kinds of restrictions.

The one that drives me batshit-insane is "maximum length". WTF?

try pasting into any facebook text-entry widget (e.g., chat). editing is completely broken. multi-paragraph text is chopped off when submitted. etc. rather amazing when you consider how much money software engineers make at that company.

Engineers don't often get to chose the features they work on, or to what degree they get polished. If it amazed me, I would direct such amazement to the correct person :`D

</attempt at humorous pedantry>

your point is well taken. software engineers are often subject to the whims of PMs and execs, and aren't always able to pursue the level of excellence they (the engineers) might prefer.

Is there any reason at all for not allowing spaces in CC numbers or other long strings of digits?

I tend to write applications such that spaces and dashes are removed on input from long strings of digits and then optionally re-added on display. But I've come across case where dashes and spaces (in this case in product's serial number) were significant.

Reply on news.ycombinator.com