4 ms·
Similarly, don't disable submit buttons so you can wait for me to type something. Especially for login forms, many password managers don't type usernames and pa
by thesuitonym 3y ago
Similarly, don't disable submit buttons so you can wait for me to type something. Especially for login forms, many password managers don't type usernames and passwords, but some login forms wait for you to type something before they'll allow you to submit.
- pimlottc 3y agoFurthermore, these forms often don't notice when your password manager has filled in the fields for you, so you have to go back and make a meaningless edit (e.g. add and then remove a character) in order to enable to the submit button.
- Semaphor 3y agoLike ebay
- sefrost 3y agoEvery time I have to do something like that I wonder how people like my parents manage to use computers.
- extraduder_ire 3y agoI assume they're in the group of users these sorts of interfaces are designed for. Hunt and peck typing, will dutifully following the flow chart of interaction across multiple pages and assume they are wrong when they are made to start again when they click a wrong button, and not being annoyed when the "you are being logged out in 30 seconds. Cancel?" message pops up. Or, they are used to finding someone who's "good with computers" to assist. That alone probably hides so much garbage UX from being known to developers.
- beambot 3y agoMy parents used punch cards and DIP switches to control their first computers. They think modern computers are basically magic by comparison...
- dpkirchner 3y agoI've watched my parents use phones. The main things that throw them off are borderless buttons, long-press actions, and swiping/dragging table rows. If we could all agree to stop implementing these that's be great.
- Baguette5242 3y agoI think it is the case for PayPal.
- Semaphor 3y agoNope, never had that issue with them, only ebay
- graftak 3y agoThat’s an implementation error and not inherent to a disabled button.
- zamadatix 3y agoI think it's better to let the user click the button and then have it tell them why the submission didn't work instead of just disabling the ability to submit. Put all the onus on figuring out what's specifically missing/invalid on the validation code, not the user.
- SilasX 3y agoSufficiently advanced “inability to implement it right” is indistinguishable from bad design.
- abdullahkhalids 3y agoYes. But secure password managers should be registering a virtual keyboard and typing into the fields with it, instead of using the clipboard which can very easily lead to exposing your password.
- danShumway 3y agoNeither is necessary. Secure password managers should directly set the value attribute on the text fields (the password manager has direct access to the page's DOM), and then they should use a DispatchEvent to notify the page that the field has changed. Websites, applications, and login forms should handle those generic events rather than listening specifically to keydown events. There's really no need to simulate typing or to touch the clipboard if you're using a browser extension; and while I haven't checked, I'd honestly be kind of surprised if any of the major password manager extensions are doing so. Of course, if for some reason the user decides to copy and paste their password, then a change event should also be handled, not just a keydown event.
- abdullahkhalids 3y agoKeepassxc has an auto-type command that does type in the username/password into your "last viewed window". This is for cases when you don't have a browser extension or want to put in a password into the terminal, or some electron app.
- danShumway 3y agoThat's a good point, although I would argue that's not what most users are going to run into, and I would note that properly handling a `DispatchEvent` and listening for changes will also properly handle KeepassXC's situation. My main point is that it's not a security issue that browser extensions don't simulate a keyboard. I'll grant that some applications need to simulate a keyboard because they don't have any access to the page or application, and yeah, they have a good reason for what they're doing, but it's a rare situation. And it is technically generally not ideal for a password manager to be doing that for websites; it does tend to make the user more vulnerable to phishing attacks. But it's fine, I see the use-case, I don't think KeepassXC is wrong to include that feature or that users are wrong to use it. It just shouldn't be impacting how login forms are designed or what events they listen to. The users who are complaining above about login forms not listening to the correct events are most likely not being insecure and are most likely not using a clipboard when they fill in their passwords, and if the password managers they're using within their browser swapped from DOM manipulation over to simulating a keyboard, that would make those password managers less secure. Simulating a keyboard is something a secure password manager should mostly avoid unless for some reason it doesn't have access to the DOM.