Thread

<input type="password" maxlength="20"> prevents me from logging into Vanguard

66 points · 99 comments · tanin

coaksford · 1790984245 · focus · HN ↗
All my worst experiences with password length have been banking and finance and it boggles my mind that they all get something so incredibly basic so incredibly wrong. What is it about this sector that makes it so?
1. sergiotapia · 1790984954 · focus · HN ↗
  Don't get me started on passkeys, where it seems it was made for people who literally only use one device: their phone.
  Every time I prodded for a passkey I have to run a grep in my brain, what app did I use, or what it an extension, under my personal or work email?
  A NIGHTMARE, and for what.
  1. winkelmann · 1790985440 · focus · HN ↗
    At least let me actually use a security key! PayPal already lets you use security keys for 2FA, but it appears they only allow for smartphone based passkeys for some reason. I'm sure these are behind all the TPMs and Secure Enclaves and whatnot, but a security key is still orders of magnitude safer.
  2. esseph · 1790985473 · focus · HN ↗
    My passkey is stored in my password manager and is available across devices with no hassle.
    xigoi · 1791010757 · focus · HN ↗
    Until you need to log in on some random device. Or inside an in-app browser popup.
    esseph · 1791030249 · focus · HN ↗
    Huh? Do you not understand how this works?
    So passkey is saved to my account. Account is logged in on multiple devices, secured with an additional pin.
    It doesn't matter what device I'm on, I can either use the app on a mobile device or a browser.
    Site goes to login, prompts me for passkey, I type in PIN and select the passkey from my password manager.
    It's fast and easy to use.
    If I am on a random device (which never happens, ever) I would just log in via browser, or use one of my hardware tokens if I were expecting to access something from an unusual device.
    skylurk · 1791045025 · focus · HN ↗
    Sometimes I need to sign in to a personal Github account on a work laptop, so I hope non-passkey flows keep working. I don't install my personal password manager on a work laptop.
    esseph · 1791053016 · focus · HN ↗
    I would use hardware token for that use case

Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.