Hacker News Reader

Comment by socillion | Hacker News Reader

A similar annoyance is writing a well-thought out forum post, pressing submit, and being told in some way that your session has expired.

Some sites you can go back to retrieve your post, others will just present you with a newly empty form.

View on HN

I've actually been conditioned so thoroughly by flaky forum software to ctrl-a-c on every post before submit that I don't even think about it and sometimes I'm surprised when I paste later and get whacked with a giant forum post.

I also do this. Not just on forums, but on pretty much anything where I write a decent amount of text. I also use a clipboard manager in conjunction with this habit (http://itunes.apple.com/us/app/clipboard-history/id420939835...) that has saved my ass numerous times.

I have dealt with this a number of times, and any time I think I am going to write a comment that is more than a few lines long and has any real significance to me, I do it in a word processor or full text editor where I can easily review it and spell check it before posting.

Or losing half the fields due to a validation error, which then creates other validation errors when you re-submit. "Oops! Your password contains illegal characters. Please select a new password. (submit) Oops! Please select a state from the dropdown menu."

I recently purchased new insurance. One company's site created its own scrolling widget for drop downs. Not sure why, but each page had several of these devil widgets.

If you spun the mouse wheel every single custom scroll widget would rapidly change value! Things like jumping from "Single" to "Divorced." I ended up just dropping them from my comparison because I was so unsure of the data I had provided them.

I really find it annoying that I have to retype my password whenever there is an error with a completely non-related part of the form.

I know that it would be irresponsible for them to send me back my password in plain text, so I guess I can live with it. But it is still annoying.

There are straight forward workarounds for this problem. The password field is typically obscured anyway, so the user doesn't see the characters in the field. When a user submits a form where they are asked for a password and a confirmation, you can temporarily persist that data on the server side, linking it to the user's session. You then send a dummy string to the client that matches the length of their supplied password, so that A) the user doesn't have to re-fill your password & confirmation, and B) the raw password data is not sent back to the client.

Good implementations of this approach also don't persist the password in plain-text in the temporary store. You crypt the password using whatever method you were going to when you stored it in the database and keep that around until you're ready to make the changes permanent.

If filling the password in will result in plain text passwords being sent back, you have already lost, because you just submitted a plain text password over HTTP. Similarly, if you're on SSL, it's plain text in neither direction. In either case, sending it back in the form has not changed the security situation.

I'm assuming this is levelled at HN? It's probably the only forum I use regularly where I get timeout's on submission. And the timeout page isn't even friendly either.

at least the back button works

HN (and trac) handle the situation best: they don't invalidate the page data, so your post will still be there. You CTRL/CMD A+C then get back to your posting with a refreshed cookie/session.

Many other forums basically wipe out your post, which is highly frustrating.

I Ctrl+R and FF refills the form data.