Ask HN: HN's login page and password manager autofill issue

27 pointstwitexplore3y ago13 comments

https://news.ycombinator.com/login

My password manager can't tell the difference between the login username text box and the new account username text box.. It fills in both, then sends an enter command, activating the button for new account.

I am a tester, not a developer, but I observed that the name id on both text boxes are the same. Maybe change the new account username form "name" to "new-acct-username" and the password managers might handle it better?

13 comments

Tomte3y ago

Nobody here can do anything about it. Write hn@ycombinator.com. You'll get a reply. The admin is quite responsive to email.

Someone12343y ago

I can see how any password manager would get confused with the HTML of that page. Identically named username/password for create/login, but just happen to be in two different forms with a label to distinguish them. There's no way to determine what is what.

It may be fixable via:

- Set the autocomplete="current-password" and autocomplete="new-password" respectively (this is standard[0]).

May help a password manager figure out what is going on. Unfortunately there's nothing standard like that for username or the login button (maybe there should be?).

[0] https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes...

xwowsersx3y ago

I have noticed this on mobile in Chrome with both LastPass and 1Password where it will either only fill in the password for the login and not the username or it will fill the create account section. However, on Firefox desktop, 1Password seems to handle it just fine: https://streamable.com/3y5iku

These autofills never work perfectly IME. One thing that helps is to turn off having it try to automatically send the enter key and, instead, just allow it to fill the inputs so you can check that everything looks correct before you click to login.

dpifke3y ago

A <title> tag on that page would also go a long ways towards making it password manager friendly.

nathanaldensr3y ago

Works fine in Firefox on Android with Bitwarden.

phnofive3y ago

I'm seeing the IDs as acct and pw.

cassianoleal3y ago

They mean the IDs of the account field on both the login and the signup forms, which are on the same web page.

ComputerGuru3y ago

What kind of password manager are you using that freely puts passwords in regular ( or unmasked) text input boxes?

Edit: typo

crazygringo3y ago

What kind of password manager doesn't?

The whole point of a password manager browser extension is to autofill usernames in username boxes, and autofill passwords into password boxes. Obviously a password is never put in a box where it would be visible, it's always a masked one.

And obviously it only does it if the domain matches.

I probably log into 10-15 sites a day on average. I sure as heck don't want to have to be manually searching my password manager, and copying a username, pasting a username, copying a password, and pasting a password each time. That would be literally minutes a day of totally wasted time for no reason.

ComputerGuru3y ago

You misunderstood me. I said “into an unmasked text input field” which is different from a “password input field”

It’s one where the password isn’t replaced with •••••• as you type it and remains visible.

1 more reply

tsgagnon3y ago

Both LastPass and Bitwarden have browser extensions that will attempt to fill in login prompts on demand for sites that are detected as being connected to entries.

ComputerGuru3y ago

You misunderstood me. I said “into an unmasked text input field” which is different from a “password input field” It’s one where the password isn’t replaced with •••••• as you type it and remains visible.

DoctorOW3y ago

Bitwarden makes me explicitly fill it, maybe that's a setting I hit without realizing. It certainly doesn't attempt to automatically submit the form.

j / k navigate · click thread line to collapse

13 comments

Tomte3y ago

Nobody here can do anything about it. Write hn@ycombinator.com. You'll get a reply. The admin is quite responsive to email.

Someone12343y ago

It may be fixable via:

- Set the autocomplete="current-password" and autocomplete="new-password" respectively (this is standard[0]).

May help a password manager figure out what is going on. Unfortunately there's nothing standard like that for username or the login button (maybe there should be?).

[0] https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes...

xwowsersx3y ago

dpifke3y ago

A <title> tag on that page would also go a long ways towards making it password manager friendly.

nathanaldensr3y ago

Works fine in Firefox on Android with Bitwarden.

phnofive3y ago

I'm seeing the IDs as acct and pw.

cassianoleal3y ago

They mean the IDs of the account field on both the login and the signup forms, which are on the same web page.

ComputerGuru3y ago

What kind of password manager are you using that freely puts passwords in regular ( or unmasked) text input boxes?

Edit: typo

crazygringo3y ago

What kind of password manager doesn't?

And obviously it only does it if the domain matches.

ComputerGuru3y ago

You misunderstood me. I said “into an unmasked text input field” which is different from a “password input field”

It’s one where the password isn’t replaced with •••••• as you type it and remains visible.

1 more reply

tsgagnon3y ago

Both LastPass and Bitwarden have browser extensions that will attempt to fill in login prompts on demand for sites that are detected as being connected to entries.

ComputerGuru3y ago

DoctorOW3y ago

Bitwarden makes me explicitly fill it, maybe that's a setting I hit without realizing. It certainly doesn't attempt to automatically submit the form.

j / k navigate · click thread line to collapse