13 ms·
Safari tries to fill username
- weird-eye-issue 5y agoOh gosh. You just know the engineer who had to implement this hates the product lead even more now.
- silverwind 5y agoSafari seems to be full of such hacks, more such examples in this related story: https://news.ycombinator.com/item?id=26165357 https://news.ycombinator.com/item?id=26165357
- realusername 5y agoJust another day in web development with Safari, I'm not even surprised anymore. I've encountered so many of those "total nonsense" moments.
- Tokelin 5y agoLooks more and more like Safari is the "modern" IE
- rini17 5y agoIn the IE days the standards were manageable and relatively fixed, it was possible to have a test suite and point fingers "not compliant!". Now we have "Living Standard"...
- 1337shadow 5y agoAs a webdev I can confirm that I have exactly the same experience supporting Safari that I had supporting IE 15 years ago.
- HatchedLake721 5y agoCan you share details?
- wildrhythms 5y agoEveryone loves CSS grid layout now, right? On Safari (both iOS and OS X) Safari does not support grid-gap, i.e. "gap" CSS property. https://developer.mozilla.org/en-US/docs/Web/CSS/gap#support_in_grid_layout https://developer.mozilla.org/en-US/docs/Web/CSS/gap#support... I use the fullscreen API to give prototype demos of a product to clients, and iOS [iPhone] Safari doesn't support the fullscreen API. https://developer.mozilla.org/en-US/docs/Web/API/Fullscreen_API#document.fullscreenelement https://developer.mozilla.org/en-US/docs/Web/API/Fullscreen_...
- nonsen 5y agoI believe you can use the PWA mode for fullscreen (Share > Add to homescreen)
- HatchedLake721 5y agoLooks like gap support landed last month in Safari 14.1 https://css-tricks.com/safari-14-1-adds-support-for-flexbox-gaps/ https://css-tricks.com/safari-14-1-adds-support-for-flexbox-...
- rootusrootus 5y ago> Everyone loves CSS grid layout now, right? As someone who does not primarily do web development... no. No I do not :). I am trying to get it to do what I want in Chrome and I find I hate it only slightly less than older CSS. Anecdotally, friends have told me I shouldn't use grid, I should use flexbox instead. Clearly I'm not meant to be a web developer. Some people like it, I gather.
- deergomoo 5y agoIt’s supported grid gap (mostly) for ages. It was flex gap it didn’t support until very recently.
- 5y ago
- tarsinge 5y agoAs a non-user of Chrome, I have the same experience browsing on Chrome only/optimized websites that I had when browsing IE only/optimized websites 15 years ago.
- flats 5y agoAs a web developer, I, too, have had moments fixing a Safari bug that reminded me of dealing with IE in the past. But only passing moments, and I don’t blame Safari. Supporting multiple browsers is a uniquely annoying aspect of web development, and almost every developer uses Chrome for development (I’m a Safari user and it’s kind of a running gag at work). This means that for most developers, Safari is the main browser they have to support that isn’t the one they use for development, which is a recipe for resentment. Also, I bristle at this comparison a bit because Safari is wayyyyy better than IE ever was about adopting (and helping to draft) standards. They’re slower than the Chrome team and adopting new standards, but that’s because Alphabet and Apple’s business models are different, not because it’s an inherently good idea to adopt every new standard immediately (especially when many are focused on turning the web into a crappy replacement for native app platforms).
- 1337shadow 5y agoI disagree, they have been lagging on webcomponents supported both by FF and Chrome for years
- eitland 5y agoNo. This is a small but important detail: Chrome is the new IE. IE wasn't mainly a problem because it didn't support things, rather because it was - in the beginning - superior, but also had all sorts of non standard behaviour that Microsoft pushed and that made competition crazy hard. Oh, and also because they pushed it relentlessly in all ways including - as was later confirmed in court - illegal ways. Exactly like Chrome today except the multi billion fine and forced changes to Chrome is still only barely visible in the horizon. But we will keep pushing, won't we? For the record: I think I have contacted local authorities twice officialy over the last 18 months and maybe once over twitter. If two more people do the same here in Norway that is starting to make a difference. Same if ten people in France or Germany do it. Or if someone makes a story that goes viral or reaches the headlines somehow. Don't give up everyone! Chrome is an excellent browser but don't think for a moment that Google won't close it down the very moment it has finally crushed competition.
- deleted 5y ago[deleted]
- realusername 5y ago> No. This is a small but important detail: Chrome is the new IE. In terms of market share and market power yes it's comparable, in term of tech issues, not really no, it's not even close. Chrome has a very good rendering engine, there's a few quirks here and there, I might have encountered some strange logic once or twice but that's about it. Safari on the other hand is really comparable in terms of tech issues and the main problem is that you can't even tell people to upgrade on iOS since they are stuck with it.
- matsemann 5y ago> in term of tech issues, not really no, it's not even close It's not about tech issues. It's about pushing non-standard behavior. There are so many things Chrome implement and people start using, that other browsers have then to call them "standard" and make a similar implementation. But even worse, since Google also is controlling some of the biggest websites, they can use this functionality and cripple other browsers for not supporting their "standards". Like YT has been horrendously slow on Fx for years. Not based on Fx being slow, but YT having implementation details that happen to work well on their own browser..
- HatchedLake721 5y agoSuch as?
- realusername 5y agoLike SVG background issues https://stackoverflow.com/questions/40986798/repeated-svg-background-gaps-in-safari https://stackoverflow.com/questions/40986798/repeated-svg-ba... clicking issues https://stackoverflow.com/questions/24077725/mobile-safari-sometimes-does-not-trigger-the-click-event https://stackoverflow.com/questions/24077725/mobile-safari-s... (yeah even clicks are broken) background jank https://stackoverflow.com/questions/9983520/webkit-animation-is-leaving-junk-pixels-behind-on-the-screen/17822836 https://stackoverflow.com/questions/9983520/webkit-animation... (not sure it's exactly this bug but I do have fixes in the codebase for that) round corners https://stackoverflow.com/questions/50995411/cant-set-border-radius-on-div-enclosing-video https://stackoverflow.com/questions/50995411/cant-set-border... (still happening right now) And countless other JS and CSS bugs I forgot I have in the codebase. There's scrolling bugs, navigation bugs, layout bugs, form bugs... I'm sorry to say but nothing really "fully works" it's always slightly off one way or another.
- rimliu 5y agoThere is a browser without bugs?
- realusername 5y agoNot really no but there's a very large tech gap between both Chrome (plus associated) and Firefox and on the other hand Safari which feels like it's in "maintenance mode".
- robertoandred 5y agoNo, there's not.
- realusername 5y ago
- traveler01 5y agoWouldn't that make pishing attempts way easier?
- burlesona 5y agoNote that other commenters have shared examples of the same basic behavior in chrome and Firefox.
- realusername 5y agoWhat differs is the amount of quirks you encounter, with Firefox and Chrome, I get one of those once per year, with Safari there's multiple (and severe) issues every month.
- captainmuon 5y agoToo much magic if you ask me. There are often two ways you can do something. In this case: - Explicit clean markup and a deterministic GUI or - Tons of heuristics and a magic GUI that works great most of the time but fails in ways that are hard to understand. I feel you get this tradeoff a lot in "clever" systems. Whether it is just finding the main text on a page, blocking ads, doing search, or even self-driving cars: I often prefer the "pedestrian" approach over the "magic" approach. Even if it is a bit less powerful, it is also less surprizing.
- knorthfield 5y agoIn my opinion Safari is way too aggressive with filling usernames and passwords. Anything in any way similarly named like these it forces an autofill. And of course it overrides autocomplete="off". We definitely need an attribute that implies, "I actually know what I'm doing Safari! Please really don't autofill this."
- lloeki 5y agoConversely, there are way too many websites that (intentionally or not) prevent password managers to function, which results in these kind of heuristics being implemented by password managers in order to be generally useful.
- zwily 5y agoIf that attribute existed, security audits would again force big enterprises to enable it to break auto fill on their password fields, taking us back to square one.
- alisonkisk 5y agoSafari doesn't write the HTML, and web page authors don't write explicit clean markup, so the pedestrian approach doesn't work in the real world.
- fvold 5y agoI wonder what would happen if compilers/interpreters/lexers of various programming/scripting languages had this attitude. Why do web page authors get a pass? I mean, most web page authors today at least also do JavaScript, where a single out-of-place character can cause the whole thing to simply break. Yeah yeah, legacy and all that, but that's why we have doctypes.
- pdenton 5y agoWelcome back! Please leave a comment
- bellyfullofbac 5y agohunter2
- onion2k 5y ago> ******** I don't get it?
- diogenesjunior 5y agohttps://knowyourmeme.com/memes/hunter2 https://knowyourmeme.com/memes/hunter2
- bellyfullofbac 5y agoHe used *'s. He got it. ;)
- atian 5y agoWelcome back!
- WayToDoor 5y agoRelated, there is a "bug" in chrome that disabled autocomplete="off" on input elements, marked as won't fix https://bugs.chromium.org/p/chromium/issues/detail?id=587466 https://bugs.chromium.org/p/chromium/issues/detail?id=587466
- yvoschaap 5y agoYes. The Chrome devs refuse to accept there are viable cases for not allowing autocomplete.
- deleted 5y ago[deleted]
- vincnetas 5y agoIt's not up to Chrome devs to accept or deny viable use cases. As someone from comments mentions, it's in the spec, and chrome devs should not deviate from that irrelevant if what they think is accepted or not accepted use case. Or they should go and push for spec change.
- eru 5y agoWhy? The spec ain't God given.
- irjustin 5y agoThat's how we ended up with decades of Internet Explorer.
- monsieurbanana 5y ago> Or they should go and push for spec change
- thaumasiotes 5y agoThat attitude basically endorses the idea that the spec is God-given. There's nothing so important about getting the spec changed before you start ignoring it.
- alisonkisk 5y agoWhats the point of this feature? Even if the username is needed, Safari can't do anything with it if it can't find a form field to put it in.
- bryanrasmussen 5y agoI just imagine the scenario of someone getting nostalgic for Welcome Back, Kotter, firing up Safari and having this happen on every fan page they try to surf. On the other hand I guess it must also happen on every page that mentions this bug.
- brandrick 5y agoThe assumption here that this is being triggered because Safari assumes any page with this phrase must be a login page sounds plausible (if odd) to me. However, anecdotally I imagine there will be an uptick in sites using similars phrases — as following easing of Covid restrictions around the world even little brick and mortar stores will be making such welcoming statements on/across their homepages. :D
- knorthfield 5y agoExactly, and isn't it likely to be used equally as a post login phrase? Which is how I discovered this "bug" in the first place!
- pilsetnieks 5y agoThis smacks of a special case processing for some specific site. I suspect there's some wildly popular service which presents a page with just a password input for returning users who haven't logged in for a while but still have their cookies/sessions active; the page is oddly coded and the standard approach doesn't work so it needs this workaround; and the page is valuable enough for Apple users that this was deemed reasonable. The first comment threads are all echoing derision of Safari as a janky browser but I feel that this is something that could be dissected 20 years later in a Raymond Chen-like blog [1] with how they had to painstakingly add a workaround in a newer version somewhere deep inside to make some questionable piece of software not crash or something. [1] https://devblogs.microsoft.com/oldnewthing/ https://devblogs.microsoft.com/oldnewthing/
- raverbashing 5y agoI can see the PM with this story "As a user I want to feel welcome back to my websites hence my login information will be auto-filled if the sites welcome me back" (Though the real issue here seems to be field identification, not the auto-fill)
- knorthfield 5y agoYes. I thought changing the field to type="search" may avoid it but alas no.
- candylifter 5y agochanging the name attribute seems to work, e.g. name="search"
- GistNoesis 5y agoDoes it work in other languages ?
- niek_pas 5y agoJust tested it in Dutch ("Welkom terug"), which does not trigger the autocomplete.
- gvx 5y agoIs the Safari UI in Dutch for you? (I never set UI language to Dutch if I can avoid it even though it's my native language, the localization is often so clunky that I find it distracting)
- maybevain 5y agoI tested it with my native language (both the text on the website and the browser UI). The autofill interface did not show up. Then again Finnish has anyway been a second class citizen when it comes to iOS features.
- newbie578 5y agoWhy would someone even use Safari instead of Chrome? Hell I would rather use Edge.
- SethMurphy 5y agoI occasionally use Safari to extend battery usage on a laptop. For me Chrome uses significantly more power.
- niek_pas 5y agoChrome tears through RAM and battery
- HatchedLake721 5y ago1. Privacy 2. Battery 3. Performance
- amelius 5y agoYour no. 1 reason is being questioned by the article, though.
- TonyTrapp 5y agoOffering autofill (it's not actually automatically filling in) doesn't really violate privacy, does it? And if you don't want your browser to autofill passwords at all, then don't keep any passwords in its password store.
- Zardoz84 5y agoWhy would someone even use something that isn't Firefox.
- viktorcode 5y agoFirefox feels too clunky and non-native in macOS. You'll notice it straight away
- 5y ago
- samjmck 5y agoIt _wants_ to autofill, but it doesn't without the user actually confirming the autofill. Pretty important distinction to make I think
- rd11235 5y agoAgree. Current title is inaccurate and click baity. Also, the confirmation requires authentication (at least by default, unsure if this can be changed).
- okamiueru 5y agoIn case it changes, for context, the current title is > The phrase “welcome back” on a page causes Safari to autofill a password
- lucb1e 5y agoNot just that, the "a password" is also not leaking a stored password to a random website that contains this string, it's really just popping up the autofill prompt with the passwords that you explicitly stored for this specific website.
- emilfihlman 5y agoChrome also breaks CSS conventions and mark it as wontfix. Basically Chrome is just awful.
- hnbad 5y agoSafari is not Chrome though.
- pornel 5y agoThere was probably an important website somewhere that had a login page with a shitty markup, and Safari users complained that autofill "doesn't work" there. Garbage markup got a garbage workaround.
- tomcooks 5y agoAnything but following standards and making sure that upon joining the internet new users either know how to use the tools, or know what the consequences can be. I miss netiquette and RTFM
- judge2020 5y agoThat was a time of the internet being a ‘nerd’ thing and using it took intrigue into how it works alongside how to use it. Now quite literally more than half the planet needs to use it since it allows instant communication and you can’t expect everybody (or even most people) to spend the time to learn how it works when they can just chalk it up to ‘magic’ and continue with their life.
- ChrisMarshallNY 5y agoI don't see this as a bug. Password autocomplete is kind of a dumpster fire. It varies, depending on which sites I visit. I use 1Password, with browser integrations (it works better with Safari than Chrome). I don't know most of my passwords; relying on 1Password to access the strings of garbage I autogenerate. So I am constantly using it to fill forms. It keys on things like attached <label>...</label> elements. Not all sites use these. Some sites also sometimes add some kind of junk that causes 1Password to fail. Other times, 1Password insists that the field I just selected needs an autofill; even for non-auth fields. Not really a big deal for me. No one that shouldn't gets my auth, and I ignore the prompt when it is not necessary.
- techrat 5y agoI use BitWarden and have come to prefer something about BitWarden that initially irked me coming from LastPass. There is no icon in any of the fields to click to populate them. There is no auto filling. You have to cursor into the field, right click and manually select the relevant entry to fill. From a security standpoint this is much better and safer overall. It also prevents accidental autofilling and login of an account you're trying NOT to login with on sites where you have multiple accounts and need to keep things carefully separated.
- 10000truths 5y agoWell, there is auto-filling in the sense that if you press Ctrl-Shift-L (at least on the browser extension), it will find the user/pass fields and fill them in for you. But it requires you to press the shortcut, so it doesn’t do so unprompted.
- sandyarmstrong 5y agoAuto-filling on page load in Bitwarden is an opt-in feature. Additionally, if you have Bitwarden in your toolbar, you can click the Bitwarden icon, then click the entry for the site, and it will auto-fill in the page for you. I'm surprised anyone uses context menus to do this, though I agree with you that it's probably safer.
- 5y ago
- williesleg 5y agoWelcome back
- dzhiurgis 5y agoI vaguely remember Apple saying they use ML to parse forms... Could be why. Personally I have this weird thing with Safari passwords - there's 2 sites where password dropdown would appear at top left corner for whatever reason.
- smilespray 5y agoI see odd behaviour like this too, for instance when paying via PayPal. There is an obscured password field inside one of the transition views.
- nojito 5y agoInaccurate title. Can we get it changed? It currently gives the _option_ to fill out the login info. The title implies that it fills it automatically.
- ibraheemdev 5y agoNot sure why you're getting downvoted, I thought the same thing.
- busymom0 5y agoThe title is clickbait. Both "welcome back" and "Sign In" show the blue outline around the field and safari asks the user to select a username in the dropdown without actually filling the field. The user needs to actively click on the username for safari to fill the field. I don't see how this is "bad behaviour". Seems like expected behaviour.
- jinpalmer 5y agoYour no. 1 reason is being questioned by the article, though.
- pachico 5y agoI'm wondering if in other languages it would happen too. I don't have safari so I can't try it out but, what if you wrote "bentornato"? Would it also trigger it?
- maybevain 5y agoI tested it with the ”Welcome back” equivalent in Finnish, German, French and Chinese. None of those languages caused the autofill interface to show up. Safari is in Finnish on my phone, and I used the phrase ”Tervetuloa takaisin” to test. For the other languages I used whatever Google Translate suggested.
- everydaypanos 5y agoImagine how much code like this is inside our "lightweight" browsers. All the code reviews that passed this on to production make you wonder how competent these browser makers actually are.. I think that the browser should not treat every input field as a personal info form for the current user. There are plenty of cases of web apps I can think of where disabling autocomplete is best user experience overall.
- yabones 5y agoIt scares the hell out of me thinking about this type of hacky trash anywhere near crypto or sandbox code. I like to think that they have more experienced people working on that, but I'm not quite naive enough to really believe it.
- metanonsense 5y agoThis is not really a Safari-only thing. All password managers that I have used in the past had some kind of heuristic to decide whether a field should be auto-filled or not. Here is a nice explanation by a (former?) 1Password employee (https://1password.community/discussion/94198/autocomplete-off-for-1pass-suggested-fields https://1password.community/discussion/94198/autocomplete-of...). To me as a web developer (among other things :D) this is quite annoying because password managers often hijack our forms when they decide that the label (or id or classname etc.) sounds suspiciously usernamely, passwordly or credit cardly.
- irae 5y agoAs well they should. I sometimes hate the password managers too as a web developer. I am also a 1Password user, and I hate sites that block clipboard, block pasting, block right click, basically block any kind of way I have to type even my username, not to mention annoying full size on screen keyboards that can only be used with the mouse. I don't care about the reason they have to be so intrusive in UX, probably some malware fight and/or prevention. The fact is that if I am going to use 1Password or other password managers per site, with 25 characters long passwords with symbols and numbers, I want to be able to somehow fill that in without typing each letter. Some sites don't care about this use cases as they are trying to cover the asses of non-tech-savvy users. They must protect the password123 crowd, right? So password managers need to fight back, unfortunately.
- diegoperini 5y agoAutomatic field detection is fine and good UX for password managers. What is bad is auto-fill without user action.
- xzel 5y agoI have/wrote a one line auto hot key script for typing in strings in fields that don’t allow paste. Originally intended for a tax program that doesn’t allow pasting banking passwords. The pain of making a mistake and have to enter a 30+ character password over and over still haunts me. Also, if you have a problem contact their customer support. I had a tweet get a few hundred likes about a non pastable field for a transportation website and they actually changed it later that week!
- alexander_gold 5y agohmm this is amazing. I tried https://overnightdrugsales.com https://overnightdrugsales.com to find out.
- alexander_gold 5y agohttps://overnightdrugsales.com https://overnightdrugsales.com
- soheil 5y agoThis is false. Safari does not autofill a password, it merely displays the icon for you to select a password if you choose to. It is still a bug, but there is a huge distinction because in one case you're leaking your password and in the other you're not. The title of this post should be changed. Not sure why posts like this crop up to the top so quickly without people actually understanding what's happening.
- spoonjim 5y agoThis is the more pedestrian version of the inscrutability of AI.
- calebporzio 5y agoLivewire's creator here. This problem is so bonkers and such a pain to deal with. For your amusement. Here's the code that was SUPPOSED to fix the bug: https://github.com/livewire/livewire/blob/0b3feda46a9dd6ad19c6966a0c7d9820d928fe87/js/node_initializer.js#L103-L109 https://github.com/livewire/livewire/blob/0b3feda46a9dd6ad19... https://github.com/livewire/livewire/blob/0b3feda46a9dd6ad19c6966a0c7d9820d928fe87/src/LivewireManager.php#L200-L205 https://github.com/livewire/livewire/blob/0b3feda46a9dd6ad19... And here's the podcast I recorded a while back on what a pain it is: https://laravel-livewire.com/podcasts/ep65-safari-sucks-heres-why https://laravel-livewire.com/podcasts/ep65-safari-sucks-here...
- OldGoodNewBad 5y ago>tries to Maybe “offers to” is a better way of saying this? The way this is being treated makes one thing that it goes ahead and fills in a user name without interaction. Instead it seems that login / password fields are being detected by the browser, which is expected behavior.
- northerdome 5y agoAutocomplete is a black box. Trying to build a form that consistently works with Autocomplete is basically just trial and error. There should be a standardized API for this. I understand trying to support pages that weren't built with support but it's frustrating that there is no programmatic way of defining how autofill works with your app.
- deleted 5y ago[deleted]