<story><title>Safari tries to fill username</title><url>https://github.com/livewire-ui/spotlight/issues/25</url></story><parent_chain><item><author>thaumasiotes</author><text>&amp;gt; I still can&amp;#x27;t believe that whole business managed to interpret 2FA for whole EU as &amp;quot;you MUST use SMS for 2FA!&amp;quot;.&lt;p&gt;Weeeeeelll...&lt;p&gt;I&amp;#x27;m familiar with two (2) common kinds of &amp;quot;2FA&amp;quot; implementations. TOTP and SMS.&lt;p&gt;Of those two, only SMS is actually a second factor, albeit not a particularly secure one. TOTP is fundamentally a password, and two passwords are no different than one password.</text></item><item><author>izacus</author><text>Oh man, enterprise &amp;quot;security&amp;quot; firms used by banks and other old behemoths are a cancer for users. If you want your website to actively abuse users (especially one with special needs and pretty much anyone that doesn&amp;#x27;t fit into an &amp;quot;made up average person mold&amp;quot;) get those people on board and listen to the dumb things they say.&lt;p&gt;I still can&amp;#x27;t believe that whole business managed to interpret 2FA for whole EU as &amp;quot;you MUST use SMS for 2FA!&amp;quot;.</text></item><item><author>airza</author><text>The nuance here is that brain-damaged appsec pentesters reported this as a vulnerability for years, and so tons of websites followed that advice and dutifully disabled the functionality.
But autocomplete has advantages: it lets users easily specify long, random, per-site passwords without ever having to worry about that. And when they can&amp;#x27;t do that, a pretty large percentage of them just give up and write the password down somewhere.&lt;p&gt;In the end, i find a lot of chrome&amp;#x27;s decision to implement spec-breaking behavior awful in the context of having a website that works forever (Looking at you, samesite). But this behavior rarely breaks functionality and on the whole makes the web a &lt;i&gt;lot&lt;/i&gt; more secure.</text></item><item><author>WayToDoor</author><text>Related, there is a &amp;quot;bug&amp;quot; in chrome that disabled autocomplete=&amp;quot;off&amp;quot; on input elements, marked as won&amp;#x27;t fix&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;bugs.chromium.org&amp;#x2F;p&amp;#x2F;chromium&amp;#x2F;issues&amp;#x2F;detail?id=587466&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;bugs.chromium.org&amp;#x2F;p&amp;#x2F;chromium&amp;#x2F;issues&amp;#x2F;detail?id=587466&lt;/a&gt;</text></item></parent_chain><comment><author>lucideer</author><text>&amp;gt; &lt;i&gt;TOTP is fundamentally a password&lt;/i&gt;&lt;p&gt;I see this view a lot. It&amp;#x27;s wrong. TOTP is fundamentally different to a password, as the stored &amp;quot;password&amp;quot; (by which I presume you mean the key) is never transmitted anywhere.&lt;p&gt;TOTP in fact has one property that makes it potentially* the most secure of all 2FA methods: it can be used airgapped. As the credential you type into the 2FA form is not the saved secret.&lt;p&gt;* I say &amp;quot;potentially&amp;quot; because the relative inconvenience + human factors conspire to make it less secure than e.g. U2F in most cases. But assuming hypothetical perfect conditions, there would be nothing more secure than TOTP for 2FA.</text></comment>
<story><title>Safari tries to fill username</title><url>https://github.com/livewire-ui/spotlight/issues/25</url></story><parent_chain><item><author>thaumasiotes</author><text>&amp;gt; I still can&amp;#x27;t believe that whole business managed to interpret 2FA for whole EU as &amp;quot;you MUST use SMS for 2FA!&amp;quot;.&lt;p&gt;Weeeeeelll...&lt;p&gt;I&amp;#x27;m familiar with two (2) common kinds of &amp;quot;2FA&amp;quot; implementations. TOTP and SMS.&lt;p&gt;Of those two, only SMS is actually a second factor, albeit not a particularly secure one. TOTP is fundamentally a password, and two passwords are no different than one password.</text></item><item><author>izacus</author><text>Oh man, enterprise &amp;quot;security&amp;quot; firms used by banks and other old behemoths are a cancer for users. If you want your website to actively abuse users (especially one with special needs and pretty much anyone that doesn&amp;#x27;t fit into an &amp;quot;made up average person mold&amp;quot;) get those people on board and listen to the dumb things they say.&lt;p&gt;I still can&amp;#x27;t believe that whole business managed to interpret 2FA for whole EU as &amp;quot;you MUST use SMS for 2FA!&amp;quot;.</text></item><item><author>airza</author><text>The nuance here is that brain-damaged appsec pentesters reported this as a vulnerability for years, and so tons of websites followed that advice and dutifully disabled the functionality.
But autocomplete has advantages: it lets users easily specify long, random, per-site passwords without ever having to worry about that. And when they can&amp;#x27;t do that, a pretty large percentage of them just give up and write the password down somewhere.&lt;p&gt;In the end, i find a lot of chrome&amp;#x27;s decision to implement spec-breaking behavior awful in the context of having a website that works forever (Looking at you, samesite). But this behavior rarely breaks functionality and on the whole makes the web a &lt;i&gt;lot&lt;/i&gt; more secure.</text></item><item><author>WayToDoor</author><text>Related, there is a &amp;quot;bug&amp;quot; in chrome that disabled autocomplete=&amp;quot;off&amp;quot; on input elements, marked as won&amp;#x27;t fix&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;bugs.chromium.org&amp;#x2F;p&amp;#x2F;chromium&amp;#x2F;issues&amp;#x2F;detail?id=587466&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;bugs.chromium.org&amp;#x2F;p&amp;#x2F;chromium&amp;#x2F;issues&amp;#x2F;detail?id=587466&lt;/a&gt;</text></item></parent_chain><comment><author>donatzsky</author><text>TOTP is no more a password than whatever one-time code you&amp;#x27;d get by SMS. In fact, TOTP is arguably more secure, since it isn&amp;#x27;t nearly as vulnerable to hijacking as SMS is.</text></comment>