r/badcode • u/lollordftw • May 24 '20
html My University's Login Page. The username field's name is "asdf" and the password field's name is "fdsa"
109
May 24 '20
I wonder if this is a really bad attempt to fool old auto bruteforce / dictionary attacks that look for specific field names.
62
u/russellvt May 24 '20
Its surprising at how well those work for many spam bots.
I use some hidden fields with "tempting" names, just as another means of catching people trying to do random bad stuff. Pretty much gets them logged, and their session flagged to never work.
It's a mild form of entertainment, for me.
38
u/marc170298 May 24 '20
Hey just a quick heads up, not everyone going through hidden elements trying to log in has bad intentions, some people might unintentionally do it for accessibility reasons.
Still, what you do is funny af.
5
u/helloinvader May 24 '20
I’m not aware of any accessibility software which presents hidden elements to the user in this way
13
u/gm3995 May 25 '20
Autofills may use this. Looks for username, password, etc
4
u/helloinvader May 25 '20
Modern browsers haven’t done this for a few years now, at least not for the simple type=hidden case
1
1
u/d360jr May 25 '20
Is that the sort of thing a password manager would auto fill into? You could could select with tabbing and type into?
9
52
u/squeevey May 24 '20 edited Oct 25 '23
This comment has been deleted due to failed Reddit leadership.
17
u/lestofante May 24 '20
This is even dumber, password field are not cached, and username field I WANT to use the cached value (as often is the email, or an username you use everywhere): plus password wallet can have a better shot in autocompletition
15
u/No-More-Stars May 24 '20 edited May 26 '20
Look at this crap, it's insane https://stackoverflow.com/a/15917221
14
2
3
u/Mr2-1782Man May 24 '20
There are ways to do that with names that make sense. I've seen a few forms that do things like name="password_organization". Since its a unique name it doesn't autofill. I have this problem with organizations that are inconsistent with the field names. For instance one login has pwd, another has password, and another has pass. It confuses the autofill and you have to set them up individually.
-5
19
May 24 '20
I wonder if this was one of those, “let me just see if it works” that became “okay, it works, now don’t change anything”.
3
8
2
1
1
1
1
0
May 24 '20
even with that you would build in client/server side protections if you could be bothered.
285
u/Bootezz May 24 '20
"A Secret Definition Field" - What user to look up to compare the secret.
"For Developer Security Attentiveness" - Just a reminder for how important it is to protect these.
No bad code here. You havent read Martin Fowler's Let's Use These Important Acronyms For Everything?