Leave login forms unscripted

Password managers have become an integral part of today's web browsers. They are able to determine whether the form is a login form and fill it out accordingly. However, some ugly JavaScript can confuse them and interfere with their functionality, thus breaking it.


In fact, I found two sites where I was unable to use password manager built in my Opera web browser because it was not recognizing login or password field properly due to underlying JS hocus-pocus. Firefox and Google Chrome did not even propose password saving at all. What is more, such complication may also make it impossible to submit the form using the enter key and hence require user to explicitly click on the submit button.


Advice: Do not try to be smarter than the already existing solutions by reinventing functionality of the login forms. Or at least if you have a very good reason to do this make sure that you don't break those solutions (including password managers).


Observed at: Parallels Plesk Control Panel at netarteria.pl and website of my company's business partner.

Do not limit password length

I tried to fill the registration form with my login and password. After five attempts, each refused with message password too short or too long my frustration hit a limit.

First, I would like to know whether you claim my password as too short or too long.

Second, what's the point in limiting password length if it's hash has a fixed size, independent on password length? Or maybe you don't hash the passwords? Ekhm...

Advice:  Do not put unreasonable constraints on user password. Simplifying password reduces safety and, hence, your credibility.

Observed at: www.rockserwis.pl

Do not send passwords via e-mail

Sometimes after successful registration I receive an unencrypted e-mail that contain my login and my password in plain text. What's the point in securing the registration form if, a moment later, the credentials are being exposed badly, potentially giving access to the account?

What's more, if someone unluckily broke into my e-mail account he would get an extra gift - passwords to my other accounts.

As a result, my level of trust drops significantly. How do I know that they don't store my password in plain text? Hashing of passwords is such a basic thing...

Advice: Do not send passwords via (unencrypted) e-mail. Account activation link is enough.

Observed at: www.mojwzrok.pl and many other places...