This would be immediately useful for password managers matching on window titles.
[0] https://news.ycombinator.com/login
Password managers matching on window titles to decide what password to autofill sounds very dangerous! What password manager is this?
(I can't always help but think "KeepA.." I wonder if that was intentional when they named it.)
- Title (ideally unique, like Login | Hacker News)
- Use of section heading elements for "Login" and "Create Account"
- A background color
- Set the autocomplete attribute on the two password inputs to "current-password" for login and "new-password" for Create Account. Give both username inputs the autocomplete "username"[0]
- Give the two username and password inputs unique names (e.g. username, new-username, password, new-password)
- Stop being "clever" and change to standard HTML forms. Currently, both login/create forms point to the same endpoint, with the button's "value" mutating what that end-point does. This is completely non-standard and therefore difficult for any password manager to navigate without hard-coding. Instead, have each submit to a different endpoint (e.g. login, and create-account respectively).
- The forgotten password page also points to an endpoint called "x" and the username input has a different name than either one found on the login page "s" and no autocomplete hint.
If someone wanted to target HN with a bot, circumventing this would be trivial. It only really negatively impacts legitimate users trying to use password managers.
[0] https://developer.apple.com/documentation/security/password_...
Feels like a really ineffective approach.
I'd personally rather work on a private codebase, just doing the actual implementation work, and not have to deal with people getting upset that I'm not merging PRs they've sunk a lot of time into.
My guess is that it's very difficult to keep all the details of the secret sauce hidden. They change the details very often. For example the front page is ordered by points/time^1.6, but the 1.6 changes from time to time without notice (I think it was 1.8 for some time, perhaps it's 1.8 or something else now. Some people have analyzed the front page and got compatible results, but I don't remember the exponent they found and I'm too lazy to try).
As far as "secret sauce" goes, the sauce is that the mods actively upweigh, downweigh and filter user accounts all the time. Trying to reverse engineer a working algorithm from this site's behavior is a fool's errand.
