12 ms·

Other signs that a site was built by incompetent developers (Or had too much management interference--Devs aren't always to blame!): Only works with Internet E

Other signs that a site was built by incompetent developers (Or had too much management interference--Devs aren't always to blame!): Only works with Internet Explorer Doesn't work with Internet Explorer Password must have one of 4-10 special characters, but not other special characters. (e.g.: Must contain !, @, ^, &, or parentheses, but not ;, ", etc) Passwords have no requirements Right-click is disabled Video plays as soon as the site loads Share buttons that use javascript to follow the viewport Share buttons that pop up over every single image "Want to see more" when you move the mouse to the top of the screen (Or reach the bottom of the page) (or as soon as the page loads) Slideshows of any sort

reacweb 9y ago
I agree with all your points except slideshows. Why so much hate against slideshows ?
- badosu 9y ago
  I don't have a problem with slideshows, but a reason is that, in the UX perspective, elements that animate recurringly with previously hidden content (and possibly links) is confusing and not actually used, and then when you find something you want to check you have to use the slideshow pagination, which is cumbersome. Better to properly display the points of interest.
- devopsproject 9y ago
  They are used by people who need to turn what should be 3 bullet points into a slow "presentation".
- Tactic 9y ago
  I don't like them because they make it difficult to copy and paste the whole of the content.
- hedora 9y ago
  I was talking to one of the Facebook cofounders years ago, and he put it better than I could (he wasn't talking about slideshows specifically). I don't have an exact quote but it went something like this: We don't optimize for impressions per session. Instead we optimize for the number of things a user does in a fixed amount of time, (or per session). The former is a poor proxy for the latter, and you can increase impressions by adding useless click through pages that ultimately drive away users and destroy your business in the long term. (In the short term, these things make your metrics look good.) I bring this up because slideshows are a great way to artificially boost impressions.
tclancy 9y ago
Not allowing + in an email field is one of my pet peeves. Congrats on finding an amazing-looking regex for email validation instead of thinking about it.
- Pxtl 9y ago
  Yup. The most email validation I evern implement is "there must be an @ sign with stuff before and after the @ sign". Maybe require a dot in the latter space.
  - marksomnian 9y ago
    .+@.+\..+
    - nradov 9y ago
      That regex is defective. See benchaney's reply above.
      - hfsktr 9y ago
        .+@.+(\..+)? should satisfy you both right? I use the original or a form of usually when I had to check emails.
        simcop2387 9y ago
        Fully qualified domains actually end in a . If you're allowing sally@google then you must also allow sally@google. To be valid
        eridius 9y ago
        No you don't. Email addresses explicitly require any periods in the domain to have at least one (non-period) character after the period. From RFC 5322, the relevant grammar production for the domain looks like dot-atom-text = 1*atext *("." 1*atext) (where atext is letters, digits, or a set of specific punctuation characters that doesn't include periods).
criddell 9y ago
How about case insensitive passwords? That one always bugs me because it suggests that maybe they are storing the password.
- stanmancan 9y ago
  Not true, they most likely convert all characters to a certain case before they hash it, so even if you entered PASSworD123 they convert to password123 and then hash. I believe I read that Facebook stores a few commonly mistyped versions of everyone's password. Actual password, typed as if caps lock was on, things like that.
  - mark-r 9y ago
    Sure, it's possible to do it that way. But if I were taking bets, I know where I'd put my money.
  - criddell 9y ago
    That's a good point. I'm pretty sure my bank is storing the password because they also limit it to some (small) number of characters. I'm guessing it's because the web interface is just passing it on to some ancient back-end system.
    - JadeNB 9y ago
      > I'm pretty sure my bank is storing the password because they also limit it to some (small) number of characters. I love how it's always the banks with these ridiculous password practices. I'm really glad that it's not some site where the password is protecting important information.
  - Buge 9y ago
    That reduces password entropy and makes the hashes easier to crack.
    - stanmancan 9y ago
joshvm 9y ago
We had a gem at my last university (UCL): you must rotate your password every few months, your password can't be anything like any of the previous ones (i.e. previous ones are stored, and they're not hashed), your password must contain special characters etc. Except.. it can only be 8 characters long. Anything else gets truncated (they explicitly said so). The mind boggles. I have no idea where this limitation comes from, do people just set an 8 character field in their database? Was this a problem decades ago that they figured they'd save a few megabytes of storage space? I think they've finally changed it so that the reset period is determined on your password complexity, no length limitations, and you can have 2FA (or at least mobile password reset).
- jameshart 9y ago
  > your password can't be anything like any of the previous ones (i.e. they're not stored hashed) That's... not necessarily the case. You can implement that check by only storing hashes of previous passwords, or of patterns derived form them that are also forbidden (e.g. store a bcrypt of every previous password converted to all lowercase and with numbers and symbols removed).
  - makmanalp 9y ago
    Doesn't that decrease the benefit of storing a hash? You probably know the process through which the derivative hashes are generated, which is not known-plaintext but seems kinda iffy still.
    - SamBam 9y ago
      I think it would decrease the benefit, yes. If you store the hash of the password, plus the hash of a hundred "similar" passwords, then the hacker only has to brute-force one to find that they are on the right track, and then brute-force "similar" combinations.
      - MikeTV 9y ago
        Unless you do it the other way around: Generate a list of all passwords similar to the one the user just entered and see if that matches any previous hashes. This is how Facebook's password check works [0] [0] https://security.stackexchange.com/a/53483 https://security.stackexchange.com/a/53483
grovegames 9y ago
Don't blame me for some of those things, blame my clients. I can only suggest so many times that something is bad practice, without getting fired.
- thesuitonym 9y ago
  Ah yes, I should have also mentioned clients. Can't win 'em all, huh?
kolinko 9y ago
Doesn't work on IE - depends on a business. I made a saas tool for mac developers. Fixing all the quirks would cost far more than the potential 2% users are worth to me. Slideshows - you mean even embeded Slideshare ones? Why? It's a good tool to explain certain ideas, and easily shareable one. We had our slides embeded on a TC post, and we used them as a significant source of traffic.
- thesuitonym 9y ago
  >I made a saas tool for mac developers. There was once a time where this was a workable excuse, but today's browsers are actually pretty good about following standards. If you're doing something that works in some browser, but not all, then you're likely exploiting some weird quirk of that browser. And of course, not testing if it works in x browser is different than actively stopping your webapp from running if it doesn't detect the right browser/os combination.
- hedora 9y ago
  I'd say especially embedded slideshare ones. Just link to the PDF, or I won't read your content (and my browser will probably block it anyway). I don't know what your product is, but I use four different browsers on a daily basis across three operating systems (it would have been six across 2 if not for the win10 privacy debacle, and even more if I had an android), and I want all my SAAS to work on all of them. Experience says when they don't work everywhere, IT just dumps the service for another SAAS provider and everyone cheers.
ythn 9y ago
> Doesn't work with Internet Explorer Some of us just can't be bothered. My web app is tested on Chrome, Firefox, and Edge. If you want to use IE you are on your own and I won't support you unless you give me a million dollars.
- thesuitonym 9y ago
  You don't have to support all browsers, but but generally knowing what doesn't work on IE and avoiding the big problems these days is pretty easy.
skylark 9y ago
None of that is really a red flag for me. The biggest red flag is when I make an account and they send me my username and password in plaintext in the confirmation email. Makes me cringe every time.
ge96 9y ago
You think it's a cost thing ie what the server can compute....? I forget the term I did this with openssl, Apache, I think with a cheap vps I get between 9 and 10 cost, bcrypt. Sorry if these are not directly related for hashing. A few sites I have to use for my dishwashing job work ie. share point and a card company that manages my money, as well as another by WalMart, they don't allow special characters only upper case-lower case and digits. You'd think okay length then but some have limits like a 15char limit.
dennisgorelik 9y ago
Why do you think that "Passwords have no requirements" is a sign of incompetence?
- nathas 9y ago
  Length seems like a reasonable requirement, e.g. it can't be "asd"
  - shortstuffsushi 9y ago
    Or "" ...
  - BlackFly 9y ago
    I'm pretty thankful on some websites when there are no password requirements. Like the article states, sometimes I am not coming back to that website. In truth the real annoyance for me is requiring an account. I wish more companies would just let me order without storing account details.
thewhitetulip 9y ago
So fb and Twitter are either built by incompetent devs or they have too high a mgmt interference? (Since they auto play videos)
- JadeNB 9y ago
  > So fb and Twitter are either built by incompetent devs or they have too high a mgmt interference? (Since they auto play videos) That seems like it's asked with the expectation that the obvious answer is "no", but I believe it's "yes". Well, I have no idea of the quality of their devs, but someone in the decision chain thought that auto-playing videos was a good idea, and he, she, or they were wrong.
xelxebar 9y ago
Wait. Why is zero restrictions on passwords a bad thing?
- rk06 9y ago
  there should be a minimum length. Or people will use 2-4 character passwords (often the initials of their name etc)
  - snakeanus 9y ago
    This is their problem then.
amitava82 9y ago
That sums up every govt and banking site in India.
the_watcher 9y ago
Nothing drives me crazier than random restrictions on my password. I get that there's probably justifiable reasons to limit the number of characters, but if it's a character found on a standard keyboard, it should be available.

reacweb 9y ago

I agree with all your points except slideshows. Why so much hate against slideshows ?

badosu 9y ago
I don't have a problem with slideshows, but a reason is that, in the UX perspective, elements that animate recurringly with previously hidden content (and possibly links) is confusing and not actually used, and then when you find something you want to check you have to use the slideshow pagination, which is cumbersome. Better to properly display the points of interest.
devopsproject 9y ago
They are used by people who need to turn what should be 3 bullet points into a slow "presentation".
Tactic 9y ago
I don't like them because they make it difficult to copy and paste the whole of the content.
hedora 9y ago
I was talking to one of the Facebook cofounders years ago, and he put it better than I could (he wasn't talking about slideshows specifically). I don't have an exact quote but it went something like this: We don't optimize for impressions per session. Instead we optimize for the number of things a user does in a fixed amount of time, (or per session). The former is a poor proxy for the latter, and you can increase impressions by adding useless click through pages that ultimately drive away users and destroy your business in the long term. (In the short term, these things make your metrics look good.) I bring this up because slideshows are a great way to artificially boost impressions.

tclancy 9y ago

Not allowing + in an email field is one of my pet peeves. Congrats on finding an amazing-looking regex for email validation instead of thinking about it.

Pxtl 9y ago
Yup. The most email validation I evern implement is "there must be an @ sign with stuff before and after the @ sign". Maybe require a dot in the latter space.
- marksomnian 9y ago
  .+@.+\..+
  - nradov 9y ago
    That regex is defective. See benchaney's reply above.
    - hfsktr 9y ago
      .+@.+(\..+)? should satisfy you both right? I use the original or a form of usually when I had to check emails.
      - simcop2387 9y ago
        Fully qualified domains actually end in a . If you're allowing sally@google then you must also allow sally@google. To be valid
        eridius 9y ago
        No you don't. Email addresses explicitly require any periods in the domain to have at least one (non-period) character after the period. From RFC 5322, the relevant grammar production for the domain looks like dot-atom-text = 1*atext *("." 1*atext) (where atext is letters, digits, or a set of specific punctuation characters that doesn't include periods).

criddell 9y ago

How about case insensitive passwords? That one always bugs me because it suggests that maybe they are storing the password.

stanmancan 9y ago
Not true, they most likely convert all characters to a certain case before they hash it, so even if you entered PASSworD123 they convert to password123 and then hash. I believe I read that Facebook stores a few commonly mistyped versions of everyone's password. Actual password, typed as if caps lock was on, things like that.
- mark-r 9y ago
  Sure, it's possible to do it that way. But if I were taking bets, I know where I'd put my money.
- criddell 9y ago
  That's a good point. I'm pretty sure my bank is storing the password because they also limit it to some (small) number of characters. I'm guessing it's because the web interface is just passing it on to some ancient back-end system.
  - JadeNB 9y ago
    > I'm pretty sure my bank is storing the password because they also limit it to some (small) number of characters. I love how it's always the banks with these ridiculous password practices. I'm really glad that it's not some site where the password is protecting important information.
- Buge 9y ago
  That reduces password entropy and makes the hashes easier to crack.
  - stanmancan 9y ago

joshvm 9y ago

We had a gem at my last university (UCL): you must rotate your password every few months, your password can't be anything like any of the previous ones (i.e. previous ones are stored, and they're not hashed), your password must contain special characters etc. Except.. it can only be 8 characters long. Anything else gets truncated (they explicitly said so). The mind boggles. I have no idea where this limitation comes from, do people just set an 8 character field in their database? Was this a problem decades ago that they figured they'd save a few megabytes of storage space? I think they've finally changed it so that the reset period is determined on your password complexity, no length limitations, and you can have 2FA (or at least mobile password reset).

jameshart 9y ago
> your password can't be anything like any of the previous ones (i.e. they're not stored hashed) That's... not necessarily the case. You can implement that check by only storing hashes of previous passwords, or of patterns derived form them that are also forbidden (e.g. store a bcrypt of every previous password converted to all lowercase and with numbers and symbols removed).
- makmanalp 9y ago
  Doesn't that decrease the benefit of storing a hash? You probably know the process through which the derivative hashes are generated, which is not known-plaintext but seems kinda iffy still.
  - SamBam 9y ago
    I think it would decrease the benefit, yes. If you store the hash of the password, plus the hash of a hundred "similar" passwords, then the hacker only has to brute-force one to find that they are on the right track, and then brute-force "similar" combinations.
    - MikeTV 9y ago
      Unless you do it the other way around: Generate a list of all passwords similar to the one the user just entered and see if that matches any previous hashes. This is how Facebook's password check works [0] [0] https://security.stackexchange.com/a/53483 https://security.stackexchange.com/a/53483

grovegames 9y ago

Don't blame me for some of those things, blame my clients. I can only suggest so many times that something is bad practice, without getting fired.

thesuitonym 9y ago
Ah yes, I should have also mentioned clients. Can't win 'em all, huh?

kolinko 9y ago

Doesn't work on IE - depends on a business. I made a saas tool for mac developers. Fixing all the quirks would cost far more than the potential 2% users are worth to me. Slideshows - you mean even embeded Slideshare ones? Why? It's a good tool to explain certain ideas, and easily shareable one. We had our slides embeded on a TC post, and we used them as a significant source of traffic.

thesuitonym 9y ago
>I made a saas tool for mac developers. There was once a time where this was a workable excuse, but today's browsers are actually pretty good about following standards. If you're doing something that works in some browser, but not all, then you're likely exploiting some weird quirk of that browser. And of course, not testing if it works in x browser is different than actively stopping your webapp from running if it doesn't detect the right browser/os combination.
hedora 9y ago
I'd say especially embedded slideshare ones. Just link to the PDF, or I won't read your content (and my browser will probably block it anyway). I don't know what your product is, but I use four different browsers on a daily basis across three operating systems (it would have been six across 2 if not for the win10 privacy debacle, and even more if I had an android), and I want all my SAAS to work on all of them. Experience says when they don't work everywhere, IT just dumps the service for another SAAS provider and everyone cheers.

ythn 9y ago

> Doesn't work with Internet Explorer Some of us just can't be bothered. My web app is tested on Chrome, Firefox, and Edge. If you want to use IE you are on your own and I won't support you unless you give me a million dollars.

thesuitonym 9y ago
You don't have to support all browsers, but but generally knowing what doesn't work on IE and avoiding the big problems these days is pretty easy.

skylark 9y ago

None of that is really a red flag for me. The biggest red flag is when I make an account and they send me my username and password in plaintext in the confirmation email. Makes me cringe every time.

ge96 9y ago

You think it's a cost thing ie what the server can compute....? I forget the term I did this with openssl, Apache, I think with a cheap vps I get between 9 and 10 cost, bcrypt. Sorry if these are not directly related for hashing. A few sites I have to use for my dishwashing job work ie. share point and a card company that manages my money, as well as another by WalMart, they don't allow special characters only upper case-lower case and digits. You'd think okay length then but some have limits like a 15char limit.

dennisgorelik 9y ago

Why do you think that "Passwords have no requirements" is a sign of incompetence?

nathas 9y ago
Length seems like a reasonable requirement, e.g. it can't be "asd"
- shortstuffsushi 9y ago
  Or "" ...
- BlackFly 9y ago
  I'm pretty thankful on some websites when there are no password requirements. Like the article states, sometimes I am not coming back to that website. In truth the real annoyance for me is requiring an account. I wish more companies would just let me order without storing account details.

thewhitetulip 9y ago

So fb and Twitter are either built by incompetent devs or they have too high a mgmt interference? (Since they auto play videos)

JadeNB 9y ago
> So fb and Twitter are either built by incompetent devs or they have too high a mgmt interference? (Since they auto play videos) That seems like it's asked with the expectation that the obvious answer is "no", but I believe it's "yes". Well, I have no idea of the quality of their devs, but someone in the decision chain thought that auto-playing videos was a good idea, and he, she, or they were wrong.

xelxebar 9y ago

Wait. Why is zero restrictions on passwords a bad thing?

rk06 9y ago
there should be a minimum length. Or people will use 2-4 character passwords (often the initials of their name etc)
- snakeanus 9y ago
  This is their problem then.

amitava82 9y ago

That sums up every govt and banking site in India.

the_watcher 9y ago

Nothing drives me crazier than random restrictions on my password. I get that there's probably justifiable reasons to limit the number of characters, but if it's a character found on a standard keyboard, it should be available.