Hacker News Reader

Comment by tedyoung | Hacker News Reader

I wish sites would test their forms with popular password management systems. This kind of thing happens all too often (thought perhaps not with such a high cost). Why not make it easy for people who auto-fill with these programs -- don't fight them.

(And I won't get into sites that won't let you paste passwords into their forms.)

View on HN

The testing burden is already enormous for things people want sites tested for.

Whats the solution for the busy engineer? Anyone know a Selenium plug in that let's you run with browser extensions or something? There's too many popular extensions to test manually.

This is probably so far down the list that I would be interested to hear of any kind of testing of extensions at all for non-extension companies.

Haven't seen this automated, but I have seen internal issues raised by folks within large orgs when their extension started breaking things. But it's only once you have 50+ to 100's of engineers working on a product, each with a subset of extensions installed, that you can rely on the cross product of engineers and their installed extensions for realistic coverage.

I've never worked on a team of more than 7 on a product, so even testing on Firefox is considered too much work for testing.

Put in dollars, it probably costs 5-10 million a year (if not more) to test extensions even haphazardly.

I feel like I could get pretty far building this, with that budget.

Follow this guide: https://support.1password.com/compatible-website-design/. Even if you can't test, at least try. I find that few forms take the basic steps. Most importantly: don't fuck with paste!

I mean what is there to test, really? Just use the the different input types and mark your fields as "email", "password" and so on. There is nothing to test really.

If a password manager does not work when given clear hints / type description of what is expected, then that is the fault of the password manager.

I’d settle for login forms that don’t hide the password box until you enter your username/email.

I don’t see how they benefit real users in any way, and my password manager can’t understand it, requiring manual copy/paste entry

This is (generally) done because they offer SSO functionality, and need to know whether to redirect the user to their corporate SSO page or show the password prompt.

This. If your form is broken with autofill, your form is broken.

Or 1Pass does a little bit more smart in checking before randomly entering text? It wouldn't be difficult to catch this

The problem is that all of these autofillers are already way too complex, because almost no one uses the optimal markup (adding the attribute autocomplete="cc-exp-year", in this case)—almost no one has even heard of the proper autocomplete markup here (I remember being in a conference room with two or three hundred other web developers a couple of years back, and the speaker asked who knew about autocomplete="new-password" and the likes; only three of us raised our hands: I and my coworker, and one other).

They’re already complex enough that it’s a disaster trying to figure anything out. You say it wouldn’t be difficult to catch this, but either it’ll be a special case finely tuned for this particular site, or it’ll break another site, causing expiry year to no longer be filled out where previously it was and should be.

Where are these various autocompletes detailed?

MDN has a good list: https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes...

HTML 5.2 § 4.10.18.7. Autofill:

https://www.w3.org/TR/html52/sec-forms.html#sec-autofill

I wonder how many of those devs use a password manager and just thought it was magic they didn't need to worry about when they were writing those kinds of forms.

I assumed that kind of markup had to exist, but its not my job to do web development at all, so time being finite, I'd never seen those. But I always assumed that they'd have to exist if I ever went looking. Why do people whose job it is to know these things not bother checking?

The problem is there are too many standards and they are all clutered on too many websites. I mean there should be a website listing the standard in an easy way.

Reply on news.ycombinator.com