3 ms·

I wonder if the biggest side benefit to a player like Apple getting into this game is the pressure it puts on web site developers to follow some kind of convent

I wonder if the biggest side benefit to a player like Apple getting into this game is the pressure it puts on web site developers to follow some kind of convention with their login forms. The vast majority of the time I have trouble filling a password, it's because the web developer did some wacky shit with the fields that make them unrecognizable, or in the worst case actively prevent pasting a password. It's one thing to blow off someone like 1Password, but Apple has a huge reach, they are not so easy to ignore.

freedomben 2y ago
There is a convention already, and it's quite simple. There's an "autocomplete" property on an input tag, and you can tell the browser what it's for[1]. Use "username", "email", and "current-password" for example when building a login page. ("new-password" is useful for creating an account or changing password, and the password manager can suggest a new password here instead of trying to autofill with your old password). The autocomplete attribute supports nearly everything you can imagine. Check this for a full list[2]. [1] https://developer.mozilla.org/en-US/docs/Web/HTML/Element/Input#autocomplete https://developer.mozilla.org/en-US/docs/Web/HTML/Element/In... [2] https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes/autocomplete https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes...
- minton 2y ago
  Is there a way to turn this off entirely? Something like <html autocomplete=“off”>? It’s rather annoying to have 1Password trying to fill my contact info into any form with a Name input. For example, Forum Name, Todo Name, etc.
- digging 2y ago
  I think the GP commenter is aware of that but saying "now that Apple is directly invested in managing and entering your password, it's harder to make excuses for dogshit product specs that, for example, block pasting passwords."
- NoPicklez 2y ago
  They're saying that Apple bringing this tech in will force developers to follow this convention, ss from their experience they're not. Not that there isn't a convention but people aren't following the conventions that exist.
bqmjjx0kac 2y ago
Ever used the virtual keyboard on treasurydirect.gov? I have resorted to DOM manipulation in DevTools so I can just paste my password in.
- el_benhameen 2y ago
  What a shitshow that was! I’m pretty sure they’ve deprecated that part of the login process now, though. It’s much smoother, in a relative sense.
- hackeman300 2y ago
  I think they finally changed this recently to allow you to paste in- I've resorted to the same workaround in the past though.
  - jackson1442 2y ago
    It's a real input field now!
jackson1442 2y ago
I doubt this will change anything in the space. iOS and macOS (through Safari) has offered password management for years at this point. This is just a more flexible version of that system.
babypuncher 2y ago
> actively prevent pasting a password. I will NEVER understand this one. Do they want me to pick a shitty password? I'm not gong to type a string of of 20 mixed-case and special characters into a private text box on my phone. It always takes 3 or 4 tries to even get it right.
- hot_gril 2y ago
  An alphanumeric password doesn't have to be bad or hard to remember. Mixed case and symbols don't add much security. But still, should be paste-able.
  - babypuncher 2y ago
    The problem is that I always generate a strong password with KeePassXC on my laptop, and I don't know about how bad the mobile sign in experience is until it's too late. And many systems require mixed case and/or special characters, so my password generator is configured to add these by default. This user-hostile UX decision is simply unjustifiable. It's baffling how this even gets past code review.

freedomben 2y ago

There is a convention already, and it's quite simple. There's an "autocomplete" property on an input tag, and you can tell the browser what it's for[1]. Use "username", "email", and "current-password" for example when building a login page. ("new-password" is useful for creating an account or changing password, and the password manager can suggest a new password here instead of trying to autofill with your old password). The autocomplete attribute supports nearly everything you can imagine. Check this for a full list[2]. [1] https://developer.mozilla.org/en-US/docs/Web/HTML/Element/Input#autocomplete https://developer.mozilla.org/en-US/docs/Web/HTML/Element/In... [2] https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes/autocomplete https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes...

minton 2y ago
Is there a way to turn this off entirely? Something like <html autocomplete=“off”>? It’s rather annoying to have 1Password trying to fill my contact info into any form with a Name input. For example, Forum Name, Todo Name, etc.
digging 2y ago
I think the GP commenter is aware of that but saying "now that Apple is directly invested in managing and entering your password, it's harder to make excuses for dogshit product specs that, for example, block pasting passwords."
NoPicklez 2y ago
They're saying that Apple bringing this tech in will force developers to follow this convention, ss from their experience they're not. Not that there isn't a convention but people aren't following the conventions that exist.

bqmjjx0kac 2y ago

Ever used the virtual keyboard on treasurydirect.gov? I have resorted to DOM manipulation in DevTools so I can just paste my password in.

el_benhameen 2y ago
What a shitshow that was! I’m pretty sure they’ve deprecated that part of the login process now, though. It’s much smoother, in a relative sense.
hackeman300 2y ago
I think they finally changed this recently to allow you to paste in- I've resorted to the same workaround in the past though.
- jackson1442 2y ago
  It's a real input field now!

jackson1442 2y ago

I doubt this will change anything in the space. iOS and macOS (through Safari) has offered password management for years at this point. This is just a more flexible version of that system.

babypuncher 2y ago

> actively prevent pasting a password. I will NEVER understand this one. Do they want me to pick a shitty password? I'm not gong to type a string of of 20 mixed-case and special characters into a private text box on my phone. It always takes 3 or 4 tries to even get it right.

hot_gril 2y ago
An alphanumeric password doesn't have to be bad or hard to remember. Mixed case and symbols don't add much security. But still, should be paste-able.
- babypuncher 2y ago
  The problem is that I always generate a strong password with KeePassXC on my laptop, and I don't know about how bad the mobile sign in experience is until it's too late. And many systems require mixed case and/or special characters, so my password generator is configured to add these by default. This user-hostile UX decision is simply unjustifiable. It's baffling how this even gets past code review.