Hacker News Reader

Comment by rootusrootus | Hacker News Reader

I wonder if the biggest side benefit to a player like Apple getting into this game is the pressure it puts on web site developers to follow some kind of convention with their login forms. The vast majority of the time I have trouble filling a password, it's because the web developer did some wacky shit with the fields that make them unrecognizable, or in the worst case actively prevent pasting a password. It's one thing to blow off someone like 1Password, but Apple has a huge reach, they are not so easy to ignore.

View on HN

There is a convention already, and it's quite simple. There's an "autocomplete" property on an input tag, and you can tell the browser what it's for[1]. Use "username", "email", and "current-password" for example when building a login page. ("new-password" is useful for creating an account or changing password, and the password manager can suggest a new password here instead of trying to autofill with your old password).

The autocomplete attribute supports nearly everything you can imagine. Check this for a full list[2].

[1] https://developer.mozilla.org/en-US/docs/Web/HTML/Element/In...

[2] https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes...

Is there a way to turn this off entirely? Something like <html autocomplete=“off”>? It’s rather annoying to have 1Password trying to fill my contact info into any form with a Name input. For example, Forum Name, Todo Name, etc.

I think the GP commenter is aware of that but saying "now that Apple is directly invested in managing and entering your password, it's harder to make excuses for dogshit product specs that, for example, block pasting passwords."

They're saying that Apple bringing this tech in will force developers to follow this convention, ss from their experience they're not. Not that there isn't a convention but people aren't following the conventions that exist.

Ever used the virtual keyboard on treasurydirect.gov? I have resorted to DOM manipulation in DevTools so I can just paste my password in.

I think they finally changed this recently to allow you to paste in- I've resorted to the same workaround in the past though.

It's a real input field now!

What a shitshow that was! I’m pretty sure they’ve deprecated that part of the login process now, though. It’s much smoother, in a relative sense.

> actively prevent pasting a password.

I will NEVER understand this one. Do they want me to pick a shitty password? I'm not gong to type a string of of 20 mixed-case and special characters into a private text box on my phone. It always takes 3 or 4 tries to even get it right.

An alphanumeric password doesn't have to be bad or hard to remember. Mixed case and symbols don't add much security. But still, should be paste-able.

The problem is that I always generate a strong password with KeePassXC on my laptop, and I don't know about how bad the mobile sign in experience is until it's too late. And many systems require mixed case and/or special characters, so my password generator is configured to add these by default.

This user-hostile UX decision is simply unjustifiable. It's baffling how this even gets past code review.

I doubt this will change anything in the space. iOS and macOS (through Safari) has offered password management for years at this point. This is just a more flexible version of that system.

Reply on news.ycombinator.com