8 ms·

This is an example of a common antipattern in software: some piece of software fails to correctly implement something (here, modern HTML autocomplete="cc-exp-ye

This is an example of a common antipattern in software: some piece of software fails to correctly implement something (here, modern HTML autocomplete="cc-exp-year"), and another piece of software goes through all kinds of contortions to work with incorrect or incomplete implementations with the result that it now behaves undesirably with a third piece of software. Specifically, 1Password has to do complicated guesses of what to fill where because many sites don't set autocomplete properly, so inevitably it will guess wrongly sometimes. Other examples are problems with lock files and file versioning (because programs tried to roll their own when the operating system didn't provide them), and the complexity of parsing "HTML soup" and emails with all kinds of bizarre invalid syntaxes. I can't offer a general solution, but if password managers simply refused to autofill to any field other than the one with the matching standard autocomplete attribute, web developers might start doing the right thing. (Do Safari, Chrome and Edge already do this? Only they have the clout to make it happen.) The user could still fill out a text box lacking the standard autocomplete attribute by right-clicking and manually selecting the correct field. Password managers should also get cheaper because their vendors would not need armies of developers adding workarounds for popular sites. Somehow this kind of nonsense has become culturally acceptable in the software industry. If the car industry worked this way you'd have to take your car back to the dealer once a month to be patched to take account of constantly changing fuel formulations. Standards exist for a reason.

yoz-y 6y ago
I have little faith site developers care about password managers. Many even try to block them from working due to some perceived notion that they are insecure.
- tweetle_beetle 6y ago
  I remember using a company-mandated pension website which required a very long password with a comprehensive selection of complexity requirements. To log in, the password had to be entered twice, but they had disabled the ability to use a password manager to populate them (I forget the exact mechanism). To me this is the worst of all worlds. If you put people off using your website, you are less likely to have breaches - security through misery. I wrote to them pointing out the issue and apparently it was put on their backlog for the following year. I think I received an update about it a couple of years later.
  - mPReDiToR 6y ago
    I recently got an OnlyKey. It plugs in as an HID so that passwords appear to have been typed in, not PW managed. Useful little thing, it seems too good to be true.
    - yosito 6y ago
      OnlyKey looks interesting. A few things make me skeptical though: It only supports 24 accounts, which is two orders of magnitude fewer than I have in my password manager. And the hardware design doesn't look super convenient or durable. I bought a YubiKey a few years ago, and kept in on my keychain, and before I had even used it a dozen times, the entire thing disintegrated and became unusable. Edit: I'm also a bit uneasy about securing access to all by accounts by one single PIN that can be used to unlock a physical device that is easy for someone to steal unnoticed.
    - tinus_hn 6y ago
      This means the password manager can’t check it isn’t entering your credentials on app1e.com
  - EveYoung 6y ago
    My broker asks for 4-5 random letters of my password each time, making password managers unusable as well. Thinking about it now, how would you encrypt a password using this method? Create hashes of every combination?
    - chedabob 6y ago
      Possibly using this? https://en.wikipedia.org/wiki/Shamir%27s_Secret_Sharing https://en.wikipedia.org/wiki/Shamir%27s_Secret_Sharing I think a lot of implementations don't do anything clever and just have a fixed set of combinations they use each time, so the number of stored hashes is smaller.
      - KMag 6y ago
        I thought about something similar to Shamir's Secret Sharing, polynomial fitting over a finite field, but in this case, information theory is working against you. With Shamir's Secret Sharing, you start out with your secret expressed as a finite field element, and pick N-1 polynomial coefficients uniformly randomly from your finite field, and give M different participants values of the polynomial evaluated at different points. Information theory shows that having at most N-1 points on the polynomial still leaks no information about F(0). It's as secure as a one-time pad, and in the degenerate case of N=2 over a Galois field, is in fact a XOR-based one-time-pad. The amount of entropy added at generation time is greater than the amount of entropy in the secret. In this partial password case, you'd want the "shared secret" to be a single value, and construct a polynomial such that, say 4 field elements, would always be sufficient to recover the same "secret". You're running the algorithm the wrong way, and unless you're forcing a password on the person, those letters are actually low-entropy instead of maximal entropy field points as in Shamir Secret Sharing. I really don't see a way to use polynomial interpolation in this way without leaking entropy. I thought about using something similar to Schnorr threshold signatures[0] to solve the information leakage, but then you end up storing one elliptic curve public key per password letter, and the private key for each public key is a single letter, so trivial to bruit-force. [0] https://eprint.iacr.org/2020/852.pdf https://eprint.iacr.org/2020/852.pdf
- metafunctor 6y ago
  What, is "password managers are insecure" really a thing?
  - wccrawford 6y ago
    Yup. And they are, technically, because if someone has that one login and password, they can access all your accounts. But it turns out that keeping that 1 login and password in your head and trusting the rest to your password service (especially if you let it make random passwords) is way more secure than what people do if they have to try to keep them all in their head. So it's about relative security. Both sides are correct, in their narrow views of the situation.
    - yoz-y 6y ago
      I believe security should optimise for the threat levels on the order of importance. No.1 is password reuse, which is what password managers solve.
  - yoz-y 6y ago
    Yes, if not explicitly then by their actions definitely. E.g.: there is only a single bank in France that hasn't switched to a stupid 6-8 digit system where you have to click buttons that appear in random order. Before then they often disabled autofill on passwords (luckily that could have been easily bypassed). They incessantly re-invent the wheel for 2-factor auth and so on. I find it very curious why banks of all institutions are those with the worst security.
    - benhurmarcel 6y ago
      Not sure if that's the bank you're talking about, but FYI Fortuneo lets you use a normal password.
      - yoz-y 6y ago
        Yep, Fortuneo is the one still having sane security. There might be others but when I was bank-shopping I haven't found one.
- nkrisc 6y ago
  But they (or their bosses) will care if credit card details can't be auto populated. Typically anything that slows down the user from paying gets fixed pretty quick. But you're right, browsers would have to become picky on saved credit card auto populate to force a change.
  - antihero 6y ago
    Yeah but people that use password managers are TINY fraction of users.
    - croisillon 6y ago
      oh yeah after reading the OP i totally wonder why
    - kevincox 6y ago
      All modern browsers now ship with a password manager (Firefox is currently rolling out CC filling country-by-country) so that number can't be too low.
Griffinsauce 6y ago
> I can't offer a general solution, but if password managers simply refused to autofill to any field other than the one with the matching standard autocomplete attribute, web developers might start doing the right thing. Unlikely. The password managers would just lose users. I've even caught myself being annoyed at 1Password when it doesn't work while the cause is obviously the website doing some stupid thing. I wonder how 1Password works on this problem though, do they just accept the crap and keep working on their guessing magic or do they also invest in standardization?
- chrisandchris 6y ago
  I always find it very interesting how the 1Password X (the standalone extension) team seems to work half the day just to fix some random website. At least their „fixed“ section of the release notes consists usually of a listing of websites where autofill does (did) not work [1]. [1] https://app-updates.agilebits.com/product_history/B5X https://app-updates.agilebits.com/product_history/B5X
- wwn_se 6y ago
  Some password manager allow you to config those parameters yourself but I guess that would not work in this case. Hopefully hardware tokens can help us get rid of passwords soon.
- diminutivesloop 6y ago
  One solution could be to very prominently highlight auto-filled fields especially if the standard auto-fill attributes are missing. That might at least help some users avoid submitting info they didn't intend to.
robertlagrant 6y ago
> if password managers simply refused to autofill to any field other than the one with the matching standard autocomplete attribute, web developers might start doing the right thing This is a market problem. All but the last password manager to do this would go out of business, due to reduced utility vs alternatives.
CivBase 6y ago
> Somehow this kind of nonsense has become culturally acceptable in the software industry. This seems to be particularly common in the web development world, even in the fundamental tech upon which the web is built. Missing the closing tags in your HTML? The browser will just guess where it should be for you. Missing a semicolon in your Javascript? The interpreter will just guess where it should be for you. Invalid CSS? The browser will just silently ignore it. Illegal comments in your JSON? Most parsers will just assume you meant to ignore those lines.
jacurtis 6y ago
1Password does do something to help combat the problem that OP had... they change the background color of any input that they auto-filled to be blue. Blue is a weird color for most sites and it should stand out to the user (generally in a field of white) after they auto-fill a form. I have had 1Password fill in the wrong inputs before and only noticed it because of this feature. I noticed an input higher up on the checkout form had changed blue. It caught my attention and allowed me to fix it manually. Now in this situation, it looks like Substack's UI is to blame. The secret form field appears to be heavily modified from its original form state, probably masking the blue background that 1Password attempted to give it. 1Password is in a difficult situation here. If the autofill doesn't work (because the developer of the website they are filling, uses non-standard naming), then users will blame 1Password for "not working", not their browser or the website developer. 1Password therefore has to make it work with as many forms as possible around the web, most of which are built by lazy developers trying to throw up a website during a hackathon, or from a developer that learned to code from a 1 hour youtube video. It's a tall order, from their perspective, to try to make this work with as many forms as possible, while having the fewest (ideally none) false positives. The one thing I can recommend for anyone who uses any password manager, is that before you click submit on a form that you used auto-fill for, you always look over the entire form again. Now in OP's case, I could see how they could have easily missed the extra amount (again, Bad UI substack), but this is general rule that anyone with a password manager should follow. Double check everything before you submit.

yoz-y 6y ago

I have little faith site developers care about password managers. Many even try to block them from working due to some perceived notion that they are insecure.

tweetle_beetle 6y ago
I remember using a company-mandated pension website which required a very long password with a comprehensive selection of complexity requirements. To log in, the password had to be entered twice, but they had disabled the ability to use a password manager to populate them (I forget the exact mechanism). To me this is the worst of all worlds. If you put people off using your website, you are less likely to have breaches - security through misery. I wrote to them pointing out the issue and apparently it was put on their backlog for the following year. I think I received an update about it a couple of years later.
- mPReDiToR 6y ago
  I recently got an OnlyKey. It plugs in as an HID so that passwords appear to have been typed in, not PW managed. Useful little thing, it seems too good to be true.
  - yosito 6y ago
    OnlyKey looks interesting. A few things make me skeptical though: It only supports 24 accounts, which is two orders of magnitude fewer than I have in my password manager. And the hardware design doesn't look super convenient or durable. I bought a YubiKey a few years ago, and kept in on my keychain, and before I had even used it a dozen times, the entire thing disintegrated and became unusable. Edit: I'm also a bit uneasy about securing access to all by accounts by one single PIN that can be used to unlock a physical device that is easy for someone to steal unnoticed.
  - tinus_hn 6y ago
    This means the password manager can’t check it isn’t entering your credentials on app1e.com
- EveYoung 6y ago
  My broker asks for 4-5 random letters of my password each time, making password managers unusable as well. Thinking about it now, how would you encrypt a password using this method? Create hashes of every combination?
  - chedabob 6y ago
    Possibly using this? https://en.wikipedia.org/wiki/Shamir%27s_Secret_Sharing https://en.wikipedia.org/wiki/Shamir%27s_Secret_Sharing I think a lot of implementations don't do anything clever and just have a fixed set of combinations they use each time, so the number of stored hashes is smaller.
    - KMag 6y ago
      I thought about something similar to Shamir's Secret Sharing, polynomial fitting over a finite field, but in this case, information theory is working against you. With Shamir's Secret Sharing, you start out with your secret expressed as a finite field element, and pick N-1 polynomial coefficients uniformly randomly from your finite field, and give M different participants values of the polynomial evaluated at different points. Information theory shows that having at most N-1 points on the polynomial still leaks no information about F(0). It's as secure as a one-time pad, and in the degenerate case of N=2 over a Galois field, is in fact a XOR-based one-time-pad. The amount of entropy added at generation time is greater than the amount of entropy in the secret. In this partial password case, you'd want the "shared secret" to be a single value, and construct a polynomial such that, say 4 field elements, would always be sufficient to recover the same "secret". You're running the algorithm the wrong way, and unless you're forcing a password on the person, those letters are actually low-entropy instead of maximal entropy field points as in Shamir Secret Sharing. I really don't see a way to use polynomial interpolation in this way without leaking entropy. I thought about using something similar to Schnorr threshold signatures[0] to solve the information leakage, but then you end up storing one elliptic curve public key per password letter, and the private key for each public key is a single letter, so trivial to bruit-force. [0] https://eprint.iacr.org/2020/852.pdf https://eprint.iacr.org/2020/852.pdf
metafunctor 6y ago
What, is "password managers are insecure" really a thing?
- wccrawford 6y ago
  Yup. And they are, technically, because if someone has that one login and password, they can access all your accounts. But it turns out that keeping that 1 login and password in your head and trusting the rest to your password service (especially if you let it make random passwords) is way more secure than what people do if they have to try to keep them all in their head. So it's about relative security. Both sides are correct, in their narrow views of the situation.
  - yoz-y 6y ago
    I believe security should optimise for the threat levels on the order of importance. No.1 is password reuse, which is what password managers solve.
- yoz-y 6y ago
  Yes, if not explicitly then by their actions definitely. E.g.: there is only a single bank in France that hasn't switched to a stupid 6-8 digit system where you have to click buttons that appear in random order. Before then they often disabled autofill on passwords (luckily that could have been easily bypassed). They incessantly re-invent the wheel for 2-factor auth and so on. I find it very curious why banks of all institutions are those with the worst security.
  - benhurmarcel 6y ago
    Not sure if that's the bank you're talking about, but FYI Fortuneo lets you use a normal password.
    - yoz-y 6y ago
      Yep, Fortuneo is the one still having sane security. There might be others but when I was bank-shopping I haven't found one.
nkrisc 6y ago
But they (or their bosses) will care if credit card details can't be auto populated. Typically anything that slows down the user from paying gets fixed pretty quick. But you're right, browsers would have to become picky on saved credit card auto populate to force a change.
- antihero 6y ago
  Yeah but people that use password managers are TINY fraction of users.
  - croisillon 6y ago
    oh yeah after reading the OP i totally wonder why
  - kevincox 6y ago
    All modern browsers now ship with a password manager (Firefox is currently rolling out CC filling country-by-country) so that number can't be too low.

Griffinsauce 6y ago

> I can't offer a general solution, but if password managers simply refused to autofill to any field other than the one with the matching standard autocomplete attribute, web developers might start doing the right thing. Unlikely. The password managers would just lose users. I've even caught myself being annoyed at 1Password when it doesn't work while the cause is obviously the website doing some stupid thing. I wonder how 1Password works on this problem though, do they just accept the crap and keep working on their guessing magic or do they also invest in standardization?

chrisandchris 6y ago
I always find it very interesting how the 1Password X (the standalone extension) team seems to work half the day just to fix some random website. At least their „fixed“ section of the release notes consists usually of a listing of websites where autofill does (did) not work [1]. [1] https://app-updates.agilebits.com/product_history/B5X https://app-updates.agilebits.com/product_history/B5X
wwn_se 6y ago
Some password manager allow you to config those parameters yourself but I guess that would not work in this case. Hopefully hardware tokens can help us get rid of passwords soon.
diminutivesloop 6y ago
One solution could be to very prominently highlight auto-filled fields especially if the standard auto-fill attributes are missing. That might at least help some users avoid submitting info they didn't intend to.

robertlagrant 6y ago

> if password managers simply refused to autofill to any field other than the one with the matching standard autocomplete attribute, web developers might start doing the right thing This is a market problem. All but the last password manager to do this would go out of business, due to reduced utility vs alternatives.

CivBase 6y ago

> Somehow this kind of nonsense has become culturally acceptable in the software industry. This seems to be particularly common in the web development world, even in the fundamental tech upon which the web is built. Missing the closing tags in your HTML? The browser will just guess where it should be for you. Missing a semicolon in your Javascript? The interpreter will just guess where it should be for you. Invalid CSS? The browser will just silently ignore it. Illegal comments in your JSON? Most parsers will just assume you meant to ignore those lines.

jacurtis 6y ago

1Password does do something to help combat the problem that OP had... they change the background color of any input that they auto-filled to be blue. Blue is a weird color for most sites and it should stand out to the user (generally in a field of white) after they auto-fill a form. I have had 1Password fill in the wrong inputs before and only noticed it because of this feature. I noticed an input higher up on the checkout form had changed blue. It caught my attention and allowed me to fix it manually. Now in this situation, it looks like Substack's UI is to blame. The secret form field appears to be heavily modified from its original form state, probably masking the blue background that 1Password attempted to give it. 1Password is in a difficult situation here. If the autofill doesn't work (because the developer of the website they are filling, uses non-standard naming), then users will blame 1Password for "not working", not their browser or the website developer. 1Password therefore has to make it work with as many forms as possible around the web, most of which are built by lazy developers trying to throw up a website during a hackathon, or from a developer that learned to code from a 1 hour youtube video. It's a tall order, from their perspective, to try to make this work with as many forms as possible, while having the fewest (ideally none) false positives. The one thing I can recommend for anyone who uses any password manager, is that before you click submit on a form that you used auto-fill for, you always look over the entire form again. Now in OP's case, I could see how they could have easily missed the extra amount (again, Bad UI substack), but this is general rule that anyone with a password manager should follow. Double check everything before you submit.