TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

Ask HN: Dang, could the login page get a title?

10 pointsby contr-erroralmost 2 years ago
RFE: Could the login page [0] get an HTML title element containing the string &quot;Hacker News&quot;, say &quot;Login | Hacker News&quot;?<p>This would be immediately useful for password managers matching on window titles.<p>[0] https:&#x2F;&#x2F;news.ycombinator.com&#x2F;login

8 comments

distcsalmost 2 years ago
&gt; This would be immediately useful for password managers matching on window titles.<p>Password managers matching on window titles to decide what password to autofill sounds very dangerous! What password manager is this?
评论 #36815555 未加载
Someone1234almost 2 years ago
If they&#x27;re going to update that page just add it to the list:<p>- Title (ideally unique, like Login | Hacker News)<p>- Use of section heading elements for &quot;Login&quot; and &quot;Create Account&quot;<p>- A background color<p>- Set the autocomplete attribute on the two password inputs to &quot;current-password&quot; for login and &quot;new-password&quot; for Create Account. Give both username inputs the autocomplete &quot;username&quot;[0]<p>- Give the two username and password inputs unique names (e.g. username, new-username, password, new-password)<p>- Stop being &quot;clever&quot; and change to standard HTML forms. Currently, both login&#x2F;create forms point to the same endpoint, with the button&#x27;s &quot;value&quot; mutating what that end-point does. This is completely non-standard and therefore difficult for any password manager to navigate without hard-coding. Instead, have each submit to a different endpoint (e.g. login, and create-account respectively).<p>- The forgotten password page also points to an endpoint called &quot;x&quot; and the username input has a different name than either one found on the login page &quot;s&quot; and no autocomplete hint.<p>If someone wanted to target HN with a bot, circumventing this would be trivial. It only really negatively impacts legitimate users trying to use password managers.<p>[0] <a href="https:&#x2F;&#x2F;developer.apple.com&#x2F;documentation&#x2F;security&#x2F;password_autofill&#x2F;enabling_password_autofill_on_an_html_input_element" rel="nofollow noreferrer">https:&#x2F;&#x2F;developer.apple.com&#x2F;documentation&#x2F;security&#x2F;password_...</a>
评论 #36815034 未加载
LinuxBenderalmost 2 years ago
The best way to reach dang is email <i>hn@ycombinator.com</i>
runjakealmost 2 years ago
A password manager matching on window titles would be a security vulnerability <i>without additional domain checking</i>.
userm0dalmost 2 years ago
I am curious, what password manager uses the window title instead of the current URL?<p>Feels like a really ineffective approach.
评论 #36815551 未加载
评论 #36813840 未加载
jer0mealmost 2 years ago
“If your page has a title, you’ve launched too late!”
neovialogisticsalmost 2 years ago
Modifying Login elements is something a blackhat would request.
billconanalmost 2 years ago
why can&#x27;t the HN codebase be opensourced? so that we can send PR to help improve.
评论 #36813731 未加载
评论 #36814070 未加载