5 ms·

So, it's long been my belief that, from a UX perspective, it's better to stop a user from doing the wrong thing than checking input after the fact to make sure

by zzalpha 12y ago

So, it's long been my belief that, from a UX perspective, it's better to stop a user from doing the wrong thing than checking input after the fact to make sure it's valid. So the case of disabling a button because it shouldn't be pressed given the state of the application/form/whatever is, to me, a good thing. But, you have to provide clear indications so the user knows how to resolve the situation. Anything else is actively user hostile. So: Do prevent the user from entering bad data instead of allowing them to input it and then telling them it's wrong after the fact. But don't make it impossible for the user to resolve the situation by providing unclear indications or unreasonable hoops that need to be jumped through. Random aside: notifying the user they've selected a bad password is, to me, a good thing. Actively preventing the user from enter a bad password, though, is a PITA... sometimes I really just don't care about password security (one-time login, low consequence if hacked, etc).

jdpage 12y ago
Slightly tangent to the random aside, but actively preventing the user from entering a bad password is very often bad because 99% of people implementing such a check have no idea what constitutes a good password, and the check actually enforces a bad one. (Relevant xkcd: https://xkcd.com/936/ https://xkcd.com/936/) I especially get mad at absurdly small (<200 chars) maximum lengths; a response of "but we require special characters" is bull. Increasing the size of the character space increases entropy by O(n^k) (polynomial); increasing the length increases entropy by O(k^n) (exponential). Anyone who's taken an undergrad algorithms course or even AP Comp Sci should understand this.
- Filligree 12y ago
  I'd comment on the rest of this, except... 200 chars? Really? Sure, there shouldn't be arbitrary limits, but... 200 chars?
  - coderzach 12y ago
    I use the complete works of shakespeare as my passphrase. The rhyming makes it easy to remember. You just need to type deliberately as not to make a typo.
    - logfromblammo 12y ago
      I actually used an entire paragraph from _Alice in Wonderland_ once. If I did it again, I might just make it Alice in Wasteland. How doth the little tronodile Improve his clanking tail, And pour the glowing hobo bile On every stainless scale! How cheerfully he seems to grin, How neatly spreads his claws, And welcomes desert rangers in With gently smiling jaws! Alas, your password must also contain a number, and it exceeds the maximum allowed length of 24 characters.
  - lstamour 12y ago
    I think the idea was, if it's 200 characters as a limit, then it's not small. Anything less would be small, and closer to 0, absurdly small.
  - swanson 12y ago
    Password manager.
  - ForHackernews 12y ago
    All of my passwords are actually my last two tweets chained together. This 200 character limit is really screwing me.
  - lurkinggrue 12y ago
    Given it is hashing what you type I don't see a reason to limit it.
- DiThi 12y ago
  Is that a typo? I can consider <20 chars small, but not "absurdly" depending on what.
  - jdpage 12y ago
    200 characters allows for the use of (short) passphrases. Longer would be better, though.
- dbbolton 12y ago
  I've brought this up before, but those passwords are more vulnerable to dictionary attacks: http://www.debianuserforums.org/viewtopic.php?p=11551&sid=148add51a26ba1a770278a8a4ff499f9#p11551 http://www.debianuserforums.org/viewtopic.php?p=11551&sid=14...
  - EdwardDiego 12y ago
    Sure, given an attacker having special knowledge.
- JoeAltmaier 12y ago
  ...and "increasing the character set" actually means "reducing the password space". A rainbow algorithm for instance no longer has to test any plain words at all; just the ones with vowels replaced by digits and/or a special character added to the end. Its actually LESS entropy.
- ThrustVectoring 12y ago
  What really pisses me off (looking at you, Skype) is when adding text to a password makes it no longer valid. In other words, bvclkk27 passes validation, but bvclkk27skype doesn't. So. Frustrating. The second is strictly a stronger password than the first.
  - lurkinggrue 12y ago
    It's probably to stop people from doing hunter hunter2 hunter3 as passwords.
- spb 12y ago
  > I especially get mad at absurdly small (<200 chars) maximum lengths You realize even the well-regarded bcrypt algorithm only hashes 72 characters, right?
  - jdpage 12y ago
    56, actually. It's a major shortcoming of bcrypt, and an argument in favour of algorithms like scrypt and PBKDF2. If you're committed to bcrypt, you could make an argument in favour of digesting the password with something like SHA384 first. That reduces entropy, but (a) it's strictly better than straight SHA, which is what a concerning number of people use already, and (b) it means that you're not messing up the user's pattern/mnemonic if they've got one going.
greggman 12y ago
A counter example, at least for me. I hate Hate HATE forms that try to force me to type a date, phone number, credit card number, etc into some specifically formatted form and prevent me from typing letters. Why? Problem #1: I type often. My fingers know when I've made a mistake and correct it immediately. But on a number only input field I type 456A<del>7 and because the form wasn't letting me type letters I get just 457 instead of 4567. Now I have to correct yet another mistake that was forced on me Problem #2: Delete almost never works correctly. There's a CC form [xxxx][xxxx][xxxx][xxxx]. I type want to type 123456789... I type 1235<del>4. I now have [1235][4...] instead of [1234][....] Problem #4: Paste almost never works. I have my info somewhere. I copy 123456789... I paste I get [1234][....][....][....] or I copy 1234-5678-9... and paste and I get an error. "No dashes allowed" or I get some other crap. Problem #5: Copy rarely works because I can't select all fields since they've been separated. Problem #6: 95%-99% of the time tab goes to the next place in the form but many custom forms move to the next field automatically so I type a phone number 111-222-3333 and then press tab but because the custom form assumed the moment I typed the last 3 that it would be helpful to automatically go the next field I'm now two fields ahead. You could possibly fix #2, #4 and #5 but I'd prefer just a blank field, no mucking with the input system. If you want to display some live status while I'm typing just outside the form on whether my input is correct or not yet that's fine but please don't mess up my typing muscle memory. I'd be really curious if anyone has done any serious testing on these fancy custom input "helpful" forms vs simpler plain text areas. Yet another is how about just accepting the user's input and checking if it could be what you need. For example when taking a CC card, let me type WWWWXXXXYYYYZZZZ or WWWW XXXX YYYY ZZZZ or WWWW.XXXX.YYYY.ZZZZ or WWWW-XXX-YYYY-ZZZZ or even WWWW XXXX YYYY ZZZZ. Check if you can turn that into 16 digits. If so assume it's correct. Don't force me to do it what's easy for the computer. I might have it in some other format and I want to copy and paste it. Or I might just find it easier to space out because I can then read it and more easily check for mistakes. For example accept a US phone number in XXX-YYY-ZZZZ instead of forcing me to XXXYYYZZZZ
- PhantomGremlin 12y ago
  You made some very good points. Too bad that, realistically, "nobody cares" about good interface design.

by zzalpha 12y ago

jdpage 12y ago

Slightly tangent to the random aside, but actively preventing the user from entering a bad password is very often bad because 99% of people implementing such a check have no idea what constitutes a good password, and the check actually enforces a bad one. (Relevant xkcd: https://xkcd.com/936/ https://xkcd.com/936/) I especially get mad at absurdly small (<200 chars) maximum lengths; a response of "but we require special characters" is bull. Increasing the size of the character space increases entropy by O(n^k) (polynomial); increasing the length increases entropy by O(k^n) (exponential). Anyone who's taken an undergrad algorithms course or even AP Comp Sci should understand this.

Filligree 12y ago
I'd comment on the rest of this, except... 200 chars? Really? Sure, there shouldn't be arbitrary limits, but... 200 chars?
- coderzach 12y ago
  I use the complete works of shakespeare as my passphrase. The rhyming makes it easy to remember. You just need to type deliberately as not to make a typo.
  - logfromblammo 12y ago
    I actually used an entire paragraph from _Alice in Wonderland_ once. If I did it again, I might just make it Alice in Wasteland. How doth the little tronodile Improve his clanking tail, And pour the glowing hobo bile On every stainless scale! How cheerfully he seems to grin, How neatly spreads his claws, And welcomes desert rangers in With gently smiling jaws! Alas, your password must also contain a number, and it exceeds the maximum allowed length of 24 characters.
- lstamour 12y ago
  I think the idea was, if it's 200 characters as a limit, then it's not small. Anything less would be small, and closer to 0, absurdly small.
- swanson 12y ago
  Password manager.
- ForHackernews 12y ago
  All of my passwords are actually my last two tweets chained together. This 200 character limit is really screwing me.
- lurkinggrue 12y ago
  Given it is hashing what you type I don't see a reason to limit it.
DiThi 12y ago
Is that a typo? I can consider <20 chars small, but not "absurdly" depending on what.
- jdpage 12y ago
  200 characters allows for the use of (short) passphrases. Longer would be better, though.
dbbolton 12y ago
I've brought this up before, but those passwords are more vulnerable to dictionary attacks: http://www.debianuserforums.org/viewtopic.php?p=11551&sid=148add51a26ba1a770278a8a4ff499f9#p11551 http://www.debianuserforums.org/viewtopic.php?p=11551&sid=14...
- EdwardDiego 12y ago
  Sure, given an attacker having special knowledge.
JoeAltmaier 12y ago
...and "increasing the character set" actually means "reducing the password space". A rainbow algorithm for instance no longer has to test any plain words at all; just the ones with vowels replaced by digits and/or a special character added to the end. Its actually LESS entropy.
ThrustVectoring 12y ago
What really pisses me off (looking at you, Skype) is when adding text to a password makes it no longer valid. In other words, bvclkk27 passes validation, but bvclkk27skype doesn't. So. Frustrating. The second is strictly a stronger password than the first.
- lurkinggrue 12y ago
  It's probably to stop people from doing hunter hunter2 hunter3 as passwords.
spb 12y ago
> I especially get mad at absurdly small (<200 chars) maximum lengths You realize even the well-regarded bcrypt algorithm only hashes 72 characters, right?
- jdpage 12y ago
  56, actually. It's a major shortcoming of bcrypt, and an argument in favour of algorithms like scrypt and PBKDF2. If you're committed to bcrypt, you could make an argument in favour of digesting the password with something like SHA384 first. That reduces entropy, but (a) it's strictly better than straight SHA, which is what a concerning number of people use already, and (b) it means that you're not messing up the user's pattern/mnemonic if they've got one going.

greggman 12y ago

A counter example, at least for me. I hate Hate HATE forms that try to force me to type a date, phone number, credit card number, etc into some specifically formatted form and prevent me from typing letters. Why? Problem #1: I type often. My fingers know when I've made a mistake and correct it immediately. But on a number only input field I type 456A<del>7 and because the form wasn't letting me type letters I get just 457 instead of 4567. Now I have to correct yet another mistake that was forced on me Problem #2: Delete almost never works correctly. There's a CC form [xxxx][xxxx][xxxx][xxxx]. I type want to type 123456789... I type 1235<del>4. I now have [1235][4...] instead of [1234][....] Problem #4: Paste almost never works. I have my info somewhere. I copy 123456789... I paste I get [1234][....][....][....] or I copy 1234-5678-9... and paste and I get an error. "No dashes allowed" or I get some other crap. Problem #5: Copy rarely works because I can't select all fields since they've been separated. Problem #6: 95%-99% of the time tab goes to the next place in the form but many custom forms move to the next field automatically so I type a phone number 111-222-3333 and then press tab but because the custom form assumed the moment I typed the last 3 that it would be helpful to automatically go the next field I'm now two fields ahead. You could possibly fix #2, #4 and #5 but I'd prefer just a blank field, no mucking with the input system. If you want to display some live status while I'm typing just outside the form on whether my input is correct or not yet that's fine but please don't mess up my typing muscle memory. I'd be really curious if anyone has done any serious testing on these fancy custom input "helpful" forms vs simpler plain text areas. Yet another is how about just accepting the user's input and checking if it could be what you need. For example when taking a CC card, let me type WWWWXXXXYYYYZZZZ or WWWW XXXX YYYY ZZZZ or WWWW.XXXX.YYYY.ZZZZ or WWWW-XXX-YYYY-ZZZZ or even WWWW XXXX YYYY ZZZZ. Check if you can turn that into 16 digits. If so assume it's correct. Don't force me to do it what's easy for the computer. I might have it in some other format and I want to copy and paste it. Or I might just find it easier to space out because I can then read it and more easily check for mistakes. For example accept a US phone number in XXX-YYY-ZZZZ instead of forcing me to XXXYYYZZZZ

PhantomGremlin 12y ago
You made some very good points. Too bad that, realistically, "nobody cares" about good interface design.