47
votes
How can I tell if my website visitors are using LastPass or other password managers?
Is there any way of identifying whether or not my visitors are using one of these plugins and how best to support it?
By far the best way to support password managers is to use normal <form> ...
- 559
41
votes
Are there other options besides HTTPS for securing a website to avoid text input warnings in Chrome?
is there any other way to make my connection secured ?
Google isn't just complaining about "security" (which could include a number of different topics), it is specifically targeting encryption / ...
- 4,287
33
votes
How should I handle the problem of people entering others' e-mail addresses without annoying them with "verification" e-mails?
At its root, this is a problem about verifying ownership of an email address, and as far as I know there are only two ways to practically verify ownership of an email address:
Send a verification ...
- 15.3k
18
votes
Accepted
Should I replace fillable PDFs?
Normally, I recommend replacing fillable PDFs with regular web forms
I think overall, yes, that would be the ideal solution, but you noted some of the the issues with this, which includes how to ...
- 339
13
votes
Accepted
How can I tell if my website visitors are using LastPass or other password managers?
Yes.
Users can install LastPass as a browser plugin. Thus you can rely on client side scripting languages to check if LastPass is installed.
For instance, using NavigatorPlugins.plugins allows you ...
- 374
10
votes
Should I replace fillable PDFs?
You could try to force downloading of the PDF, so that it opens in the default application for viewing PDF files instead of the browser.
See this question: How do I force files to open in the browser ...
- 209
8
votes
Is a "Show Password" option on login form safe?
Apart from the obvious security issue of someone else being able to physically see what password you are typing - which the user would be aware of anyway - there are a few security "concerns" that ...
- 42.2k
8
votes
Is it valid to have multiple form input elements with the same name?
HTML5
The non-normative section 4.10.1.3 Configuring a form to communicate with a server explicitly says that it is valid:
Multiple controls can have the same name; for example, here we give all ...
8
votes
How should I handle the problem of people entering others' e-mail addresses without annoying them with "verification" e-mails?
There is not much you can do to avoid verification mails (in case you actually need to store and verify mails at all, of course): if you display it to users or sent mails to that address, you better ...
- 209
7
votes
Accepted
Prevent form resubmit after Browser Back button click
One way to prevent this is to use the POST/Redirect/GET pattern.
Instead of directly sending a 200 after receiving the POST request, the server sends a 303 (or 302) redirect instead. The client ...
- 21.6k
5
votes
Is a "Show Password" option on login form safe?
If we are ignoring everything else you mention, (i.e. shared computer, firefox saved passwords, etc.) the "show" password feature is, by itself, not a security risk. It is for convenience and the "...
- 151
5
votes
Accepted
Is it considered spam to set "From: " header to the user's email in a contact form?
Using the user's email address as the 'from' address in a form notification email is not a good idea because it will trigger many spam filters due to a "spoofed" sender. There are two systems which ...
- 178
5
votes
Should I replace fillable PDFs?
There is no standard practise. You'll have to re-think your process:
Why do your customers have to fill out PDFs in the first place?
Do you just need structured data from the customer? Who needs the ...
- 159
4
votes
Accepted
Are search-based sites bad for SEO, and should I link to all posts instead?
Yes. Although Google can submit some forms they generally do not do so. So any content that is only available via a form submission should be assumed to be hidden from search engines.
Yes. This is ...
- 86k
4
votes
406 Not Acceptable response
Your request body is very large. If I'm correct, your request body is at least 10.4 KB in size because of all those fields that begin with chk and that have a value of at least 5 characters. That ...
- 13.5k
4
votes
How do I automatically log my users into other websites after they have given me their passwords?
You're on the right track with CURL.
What you need to do is add code that reads the website as if it's a basic HTML file then process the file replacing certain HTML code.
If some websites are basic ...
- 13.5k
4
votes
Accepted
Is a "Show Password" option on login form safe?
There is no inherent security issue with unmasking the password field per-sey. In the functional working of a site any method that can access form fields (such as server side posts or javascript) will ...
- 10.2k
4
votes
Are there other options besides HTTPS for securing a website to avoid text input warnings in Chrome?
I don't recommend, but you can bypass this message, by not using the original input text fields. You can create your own input fields, using regular div that have onkeypress event. Or you can create a ...
4
votes
Are there other options besides HTTPS for securing a website to avoid text input warnings in Chrome?
If you're just serving static files or can put a proxy in front you could use a server like caddy server which handles all of this for you by using lets encrypt, this takes the pain out of ...
- 176
4
votes
Are there other options besides HTTPS for securing a website to avoid text input warnings in Chrome?
nobody else seems to have mentioned,
if you own every machine that connects to your site
eg "this is probably not what you want"
, like a corporate setting, you can create a certificate ...
- 141
4
votes
Why is Facebook Pixel firing the gtm.formSubmit event?
I just tried setting up the default form submission trigger in a client's GMB container and was having the same problem. After a little digging around in Preview mode, I came up with the following ...
- 41
3
votes
Google Business Email Will Not Receive Online Web Form Sent Mail
This is a common problem when sending mail from a site on a shared hosting account that has its mail hosted offsite.
What your host needs to do is disable local mail delivery for your domain name. ...
- 1,231
3
votes
How can I tell if my website visitors are using LastPass or other password managers?
Most of these password managers are browser plugin based and work by populating the form fields and triggering a form submission as if the ueer pressed the submit button, to the server it appears as a ...
- 10.2k
3
votes
Accepted
Schema.org type for mobile carrier support
You could make use of the ContactPoint type to represent the support chat.
For the contactType property, Schema.org doesn’t define any values. Google, for their Corporate Contacts feature, recognizes ...
- 21.6k
3
votes
How can I determine where a login form is submitted?
You're right that the form will be submitted to https://squareup.com/mp/login, and that when you just put that URL into a browser, you get a 404. That's because when you type web addresses into a ...
- 169
3
votes
Does a contact form need to ask the user for explicit permission to be GDPR compliant?
I have a contrary opinion on this. I don't believe your checkbox collects any additional consent from the user that just submitting the form does, so I believe the checkbox can be removed because it ...
- 15.3k
3
votes
Accepted
Form submission tag not fired
Based on the information from the preview function, the event is not being sent at all as the conditions for the trigger are not met.
In the first, the form is submitted but the page path does not ...
- 1,802
2
votes
What kind of spam is this on our form?
The spammer is probably following this pattern, adapted from legitimate SEO folks who test Google indexing:
Find a few long strings that return no Google results.
Submit the strings to your form
...
- 529
2
votes
How can I tell if my website visitors are using LastPass or other password managers?
To answer the actual question, one way to detect if users are using Lastpass is to provide some type of login field and use jQuery or similar to see if Lastpass has inserted the "background-image" it ...
- 163
2
votes
How can I tell if my website visitors are using LastPass or other password managers?
You can use Javascript to detect the typing speed in the username/password fields. A variable rate suggests someone is typing it in manually while a constant rate or even no keystrokes at all (copy-...
- 121
Only top scored, non community-wiki answers of a minimum length are eligible