News for hackers. Stuff that matters.

A comment on Tips for Better Signup / Login UX.

Re:Tips for Better Signup / Login UX by bttrfl on Monday June 28, 2021 @07:31AM (#27660479)
I run a company offering form analytics [0] so I have seen plenty of real data on how people use forms. One stupid issue I've seen over and over again is a lack of trimming of email/username/password strings, say:

'[email protected] '

resulting in errors like 'invalid email'. Since whitespaces are invisible to users, they can't figure out what's wrong.

[0] https://www.useitbetter.com/features/form-analytics/

[ Parent | on HN ]
Re:Tips for Better Signup / Login UX by CJefferson on Monday June 28, 2021 @09:35AM (#27661762)
One thing I read (and checked, this was in the past) Facebook did was even do simple white stripping on passwords, as well as checking with caps-lock switched on.

While it technically might make passwords very slightly less secure, it makes life much easier for users, so I personally think it's worth the cost.

[ Parent | on HN ]
Re:Tips for Better Signup / Login UX by ecesena on Monday June 28, 2021 @01:26PM (#27664732)
See "pASSWORD tYPOS and How to Correct Them Securely" by Dropbox: https://ieeexplore.ieee.org/abstract/document/7546536

We also implemented it at Pinterest, I think it's a pretty good idea for a few common cases, especially for users typing their password on mobile.

Before doing this though, you want to make sure you have rate limits in place against brute force password checks for account takeover.

[ Parent | on HN ]
Re:Tips for Better Signup / Login UX by mtoddsmith on Monday June 28, 2021 @11:25AM (#27663116)
Wouldn't that interfere with a password manager that auto-saves?
[ Parent | on HN ]
Re:Tips for Better Signup / Login UX by shawabawa3 on Monday June 28, 2021 @11:45AM (#27663379)
no

basically the hashing algorithm they use strips out certain information, which means that e.g.

"PaSSWord123" "pAsswORD123" "PaSSWord123 " etc

all hash to the same value, and so are equivalent.

[ Parent | on HN ]
Re:Tips for Better Signup / Login UX by sib on Monday June 28, 2021 @11:54AM (#27663493)
>> "PaSSWord123" "pAsswORD123"

Wow - non-case-sensitive passwords seem like a bad idea...

[ Parent | on HN ]
Re:Tips for Better Signup / Login UX by CJefferson on Monday June 28, 2021 @12:29PM (#27663966)
Not it's still case sensitive, you can just flip all the character's case. You are only losing "one bit" of password information.
[ Parent | on HN ]
Re:Tips for Better Signup / Login UX by cratermoon on Monday June 28, 2021 @03:35PM (#27666738)
> it's still case sensitive, you can just flip all the character's case.

How is "flipping all the character's case" different from case-insensitive?

[ Parent | on HN ]
Re:Tips for Better Signup / Login UX by CJefferson on Monday June 28, 2021 @06:21PM (#27669016)
They flip all character's case in one go, and also capitalise just the first character.

So, if your password was:

fishCAT

They would accept fishCAT, and also FISHcat and FishCAT, and that's it.

[ Parent | on HN ]
Re:Tips for Better Signup / Login UX by anoncake on Monday June 28, 2021 @12:10PM (#27663713)
Pretty sure they don't do that for authentication.
[ Parent | on HN ]
Re:Tips for Better Signup / Login UX by CJefferson on Monday June 28, 2021 @12:30PM (#27663989)
They do, you can see a discussion here: https://security.stackexchange.com/questions/68013/facebook-...
[ Parent | on HN ]
Re:Tips for Better Signup / Login UX by anoncake on Tuesday June 29, 2021 @10:10AM (#27675974)
I didn't know it's still possible for Facebook to disappoint me.
[ Parent | on HN ]