4 ms·

So accurate. We had this exact discussion. Going to go with insecure warnings until we get https up shortly. For those wondering you can mask a normal text fie

by brettz 10y ago

So accurate. We had this exact discussion. Going to go with insecure warnings until we get https up shortly. For those wondering you can mask a normal text field in css input { -webkit-text-security: disc; }.

mappu 10y ago
My colleague used a custom web font where every glyph was replaced with a filled circle. Better browser compatibility, you know. Although our reason was actually to do with password managers. At $DAYJOB we have a CRM/ERP system with lots of password fields for other entities (not the current cookie user). It's increasingly difficult to opt out of browser autofill, and LastPass in particular was corrupting password data in the system whenever forms were submitted.
- fdsaaf 10y ago
  > It's increasingly difficult to opt out of browser autofill Good. I hope browsers autodetect these web font tricks and pop up similar warnings. I can't stand when some random website make thinks it can do a better job of credential security than major browser makers.
  - Symbiote 10y ago
    I think the point is more like an HR administrator who opens a web page, containing an employee's details. They need to update the employee's home phone number, but their password manager dumps the HR administrator's password into the "Set new password" field, which is therefore overwritten.
    - icebraining 10y ago
      So don't put the "set new password" field right in the employee's details page, use an extra page or popup for that.
      - mappu 10y ago
        Our application is still maintained, so we can find workarounds or restructure the form to use an extra popup (to the detriment of usability). But i'm sure many applications won't be updated, and as a result of this change, data will be silently corrupted when they are used. The browser has knowingly broken compatibility with the web application. This is a Torvalds "don't break userspace" moment.
        icebraining 10y ago
        Fair enough, that's a valid concern. But it wouldn't be solved by allowing pages to opt-out of autofill, since they'd have to be updated to use those as well.
alexdoma 10y ago
I used this same hack for a XenForo add-on [1] and even got labeled as black hat. [1] https://xenforo.com/community/threads/let-tls-wait-paid-deleted.125458/page-2 https://xenforo.com/community/threads/let-tls-wait-paid-dele...

by brettz 10y ago

mappu 10y ago

My colleague used a custom web font where every glyph was replaced with a filled circle. Better browser compatibility, you know. Although our reason was actually to do with password managers. At $DAYJOB we have a CRM/ERP system with lots of password fields for other entities (not the current cookie user). It's increasingly difficult to opt out of browser autofill, and LastPass in particular was corrupting password data in the system whenever forms were submitted.

fdsaaf 10y ago
> It's increasingly difficult to opt out of browser autofill Good. I hope browsers autodetect these web font tricks and pop up similar warnings. I can't stand when some random website make thinks it can do a better job of credential security than major browser makers.
- Symbiote 10y ago
  I think the point is more like an HR administrator who opens a web page, containing an employee's details. They need to update the employee's home phone number, but their password manager dumps the HR administrator's password into the "Set new password" field, which is therefore overwritten.
  - icebraining 10y ago
    So don't put the "set new password" field right in the employee's details page, use an extra page or popup for that.
    - mappu 10y ago
      Our application is still maintained, so we can find workarounds or restructure the form to use an extra popup (to the detriment of usability). But i'm sure many applications won't be updated, and as a result of this change, data will be silently corrupted when they are used. The browser has knowingly broken compatibility with the web application. This is a Torvalds "don't break userspace" moment.
      - icebraining 10y ago
        Fair enough, that's a valid concern. But it wouldn't be solved by allowing pages to opt-out of autofill, since they'd have to be updated to use those as well.

alexdoma 10y ago

I used this same hack for a XenForo add-on [1] and even got labeled as black hat. [1] https://xenforo.com/community/threads/let-tls-wait-paid-deleted.125458/page-2 https://xenforo.com/community/threads/let-tls-wait-paid-dele...