4 ms·

It doesn't really help if you have auto-fill enabled for your password. It should do that "no, you need to actually type your password" thing.

capableweb 5y ago
> It doesn't really help if you have auto-fill enabled for your password. If you autofill your passwords via the browser, you probably don't think very much about privacy in the first place and password-protect the history page won't change much. > It should do that "no, you need to actually type your password" thing. Yeah, that'd be awesome for us who use password managers and set our passwords to be at least 32 characters long with special characters. Please developers, never ever disable pasting passwords, it worsens security.
- unionpivo 5y ago
  I know that HN doesn't like +1 posts, but soo much this. Even worse is if you make me type them on a phone[1], I am actively hating you. As in I am actively going to recommend we switch from whatever products you support. [1] Because you purposefully broke web app so you can drive your app usage.
  - mathstuf 5y ago
    On Android, I've used KeePassDroid which had an alternate keyboard for its "autofill" support. I never had issues with that. There's the related behavior where autofill doesn't clear the "something happened" check, so you have to add a character and remove it again to tickle the "missing field" JS checks into recognizing you typed something in.
- StavrosK 5y ago
  > If you autofill your passwords via the browser, you probably don't think very much about privacy What's wrong with auto-filling passwords?
  - capableweb 5y ago
    Besides the obvious that anyone in front of your unlocked computer can see and extract your password, those passwords are also stored on disk and can be extracted via different methods. Although if you do use a Master Password to protect those passwords, you're slightly more protected.
    - StavrosK 5y ago
      All my disks are encrypted and I never leave my unattended computer unlocked. Besides, anyone in front of your unlocked password manager can see and extract your password as well.
      - capableweb 5y ago
        Same here, encryption buddies! But realistically, our setups are not the norm, in any place I've seen at least, from small personal setups to huge enterprises. Most people leave their computers with the defaults, and leave their computers unlocked all the time. For them to use a dedicated password manager is a step up as password managers are built for security. The password manager built-in in your browser is meant for comfort. Password managers usually hides the passwords, removes them from the clipboard, auto-locks themselves after X minutes and more, while the strongest protection the browser password managers have is a master password. So yes, probably for you it's fine, because you have other measures. But for most others, especially casual users, they don't have those measures and would be better off with a password manager.
        mywittyname 5y ago
        Every place that I've worked has a pretty serious policy that machines need to be locked when you're away from the computer. They also force full disk encryption on all machines and the "defaults" are managed by corporate IT and are often annoyingly strict. Plus, offices generally have some sort of physical security preventing anyone from just walking through, and with open offices, it's pretty damn obvious when someone is using a computer belonging to another person.
- tantalor 5y ago
  > you probably don't think very much about privacy This is about security, not privacy. I lock my machine whenever I'm not in front of it, and require password/fingerprint to unlock.
  - capableweb 5y ago
    Haha, well, I'd say it's about both :) And why do you require a password/fingerprint to unlock your machine? Is that not to preserve your privacy or is there some other reason?
akersten 5y ago
> It should do that "no, you need to actually type your password" thing. That would be a delicious egg-on-face from the Google that pushed the 'aggressively ignore autocomplete=off on password fields' in Chrome because they thought that no real web site should have a reason to disable that.
ummonk 5y ago
I use Safari so the autofill of passwords is controlled by Face ID / Touch ID.

capableweb 5y ago

> It doesn't really help if you have auto-fill enabled for your password. If you autofill your passwords via the browser, you probably don't think very much about privacy in the first place and password-protect the history page won't change much. > It should do that "no, you need to actually type your password" thing. Yeah, that'd be awesome for us who use password managers and set our passwords to be at least 32 characters long with special characters. Please developers, never ever disable pasting passwords, it worsens security.

unionpivo 5y ago
I know that HN doesn't like +1 posts, but soo much this. Even worse is if you make me type them on a phone[1], I am actively hating you. As in I am actively going to recommend we switch from whatever products you support. [1] Because you purposefully broke web app so you can drive your app usage.
- mathstuf 5y ago
  On Android, I've used KeePassDroid which had an alternate keyboard for its "autofill" support. I never had issues with that. There's the related behavior where autofill doesn't clear the "something happened" check, so you have to add a character and remove it again to tickle the "missing field" JS checks into recognizing you typed something in.
StavrosK 5y ago
> If you autofill your passwords via the browser, you probably don't think very much about privacy What's wrong with auto-filling passwords?
- capableweb 5y ago
  Besides the obvious that anyone in front of your unlocked computer can see and extract your password, those passwords are also stored on disk and can be extracted via different methods. Although if you do use a Master Password to protect those passwords, you're slightly more protected.
  - StavrosK 5y ago
    All my disks are encrypted and I never leave my unattended computer unlocked. Besides, anyone in front of your unlocked password manager can see and extract your password as well.
    - capableweb 5y ago
      Same here, encryption buddies! But realistically, our setups are not the norm, in any place I've seen at least, from small personal setups to huge enterprises. Most people leave their computers with the defaults, and leave their computers unlocked all the time. For them to use a dedicated password manager is a step up as password managers are built for security. The password manager built-in in your browser is meant for comfort. Password managers usually hides the passwords, removes them from the clipboard, auto-locks themselves after X minutes and more, while the strongest protection the browser password managers have is a master password. So yes, probably for you it's fine, because you have other measures. But for most others, especially casual users, they don't have those measures and would be better off with a password manager.
      - mywittyname 5y ago
        Every place that I've worked has a pretty serious policy that machines need to be locked when you're away from the computer. They also force full disk encryption on all machines and the "defaults" are managed by corporate IT and are often annoyingly strict. Plus, offices generally have some sort of physical security preventing anyone from just walking through, and with open offices, it's pretty damn obvious when someone is using a computer belonging to another person.
tantalor 5y ago
> you probably don't think very much about privacy This is about security, not privacy. I lock my machine whenever I'm not in front of it, and require password/fingerprint to unlock.
- capableweb 5y ago
  Haha, well, I'd say it's about both :) And why do you require a password/fingerprint to unlock your machine? Is that not to preserve your privacy or is there some other reason?

akersten 5y ago

> It should do that "no, you need to actually type your password" thing. That would be a delicious egg-on-face from the Google that pushed the 'aggressively ignore autocomplete=off on password fields' in Chrome because they thought that no real web site should have a reason to disable that.

ummonk 5y ago

I use Safari so the autofill of passwords is controlled by Face ID / Touch ID.