HN Explorer

Ask HN: HN's login page and password manager autofill issue

27 points by twitexplore ↗ HN
https://news.ycombinator.com/login

My password manager can't tell the difference between the login username text box and the new account username text box.. It fills in both, then sends an enter command, activating the button for new account.

I am a tester, not a developer, but I observed that the name id on both text boxes are the same. Maybe change the new account username form "name" to "new-acct-username" and the password managers might handle it better?

16 comments

[ 3.8 ms ] story [ 46.8 ms ] thread
Tomte
Nobody here can do anything about it. Write hn@ycombinator.com. You'll get a reply. The admin is quite responsive to email.
ComputerGuru
What kind of password manager are you using that freely puts passwords in regular ( or unmasked) text input boxes?

Edit: typo

tsgagnon
Both LastPass and Bitwarden have browser extensions that will attempt to fill in login prompts on demand for sites that are detected as being connected to entries.
DoctorOW
Bitwarden makes me explicitly fill it, maybe that's a setting I hit without realizing. It certainly doesn't attempt to automatically submit the form.
ComputerGuru
You misunderstood me. I said “into an unmasked text input field” which is different from a “password input field” It’s one where the password isn’t replaced with •••••• as you type it and remains visible.
crazygringo
What kind of password manager doesn't?

The whole point of a password manager browser extension is to autofill usernames in username boxes, and autofill passwords into password boxes. Obviously a password is never put in a box where it would be visible, it's always a masked one.

And obviously it only does it if the domain matches.

I probably log into 10-15 sites a day on average. I sure as heck don't want to have to be manually searching my password manager, and copying a username, pasting a username, copying a password, and pasting a password each time. That would be literally minutes a day of totally wasted time for no reason.

ComputerGuru
You misunderstood me. I said “into an unmasked text input field” which is different from a “password input field”

It’s one where the password isn’t replaced with •••••• as you type it and remains visible.

[deleted]
(comment deleted)
phnofive
I'm seeing the IDs as acct and pw.
cassianoleal
They mean the IDs of the account field on both the login and the signup forms, which are on the same web page.
xwowsersx
I have noticed this on mobile in Chrome with both LastPass and 1Password where it will either only fill in the password for the login and not the username or it will fill the create account section. However, on Firefox desktop, 1Password seems to handle it just fine: https://streamable.com/3y5iku

These autofills never work perfectly IME. One thing that helps is to turn off having it try to automatically send the enter key and, instead, just allow it to fill the inputs so you can check that everything looks correct before you click to login.

nathanaldensr
Works fine in Firefox on Android with Bitwarden.
Someone1234
I can see how any password manager would get confused with the HTML of that page. Identically named username/password for create/login, but just happen to be in two different forms with a label to distinguish them. There's no way to determine what is what.

It may be fixable via:

- Set the autocomplete="current-password" and autocomplete="new-password" respectively (this is standard[0]).

May help a password manager figure out what is going on. Unfortunately there's nothing standard like that for username or the login button (maybe there should be?).

[0] https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes...

[deleted]
(comment deleted)
[deleted]
(comment deleted)
dpifke
A <title> tag on that page would also go a long ways towards making it password manager friendly.