News for hackers. Stuff that matters.
Re:Substack's UI and 1Password temporarily cost me $2k by oefrha on Monday March 22, 2021 @09:10PM (#26549727)
If your UI can charge me $2023 instead of $250 without so much of a confirmation, your UI is just a minefield. Forget about auto fill, humans make typos in a free entry text box.
Re:Substack's UI and 1Password temporarily cost me $2k by mewse on Tuesday March 23, 2021 @12:48AM (#26551243)
Many many years ago I once made a $6900 payment on a $69 internet bill because of a misplaced decimal point, with no confirmation before the amount was debited from my bank account. Definitely partly my fault for missing it, but they also didn’t design that payment flow to stop it from happening or even to autofill the correct payment amount.

(I was super unlucky that it happened when I’d just received a big performance bonus, or the bank would have simply declined the transaction outright due to me not having anything remotely like that much money in my accounts)

It took a surprising number of customer service calls (and then weeks) to get that payment refunded. And more than once I had to explain to a service rep that no, I didn’t want to just leave my internet service account balance thousands of dollars in credit so I wouldn’t need to pay the monthly bill for the next decade. I mean, obviously.

Making rent was kind of challenging that month.

Re:Substack's UI and 1Password temporarily cost me $2k by benhurmarcel on Tuesday March 23, 2021 @07:28AM (#26553744)
In Germany, when paying at a restaurant, the machine often asks you to type the tip you want, before your card PIN. The (badly lit) screen also tells that to the user in German, which doesn't help if you don't speak it.

It has happened quite often that I typed my PIN by habit and the machine just refused a tip amount that large, thankfully.

Re:Substack's UI and 1Password temporarily cost me $2k by bellyfullofbac on Tuesday March 23, 2021 @01:07AM (#26551328)
From the user (donator)'s point of view, a confirmation is a good thing. From their point of view, asking someone to confirm if they really want to donate X is a chance to lose legitimately-entered X's.

And obviously from their point of view, OP actually entered $ 2023 and was fully aware of what he was doing (they didn't know about the bug)

Re:Substack's UI and 1Password temporarily cost me $2k by oefrha on Tuesday March 23, 2021 @03:50AM (#26552213)
If your business’s success depends on charging people money they’ll regret spending once they see a payment confirmation one second later, you should find a new business idea asap.