Hacker News Reader

Comment by JohnTHaller | Hacker News Reader

> There are also sites that will kill your page history by going through a bunch of redirects to prevent you from leaving with the back button.

It's 2016 and Microsoft is incapable of creating a reliable cross-site login system. Instead, we still have the disastrous mess that is live.com. Minimum 2 redirects - at least 1 of which is Javascript (seriously?) - to handle a simple login. And when your cookies go a bit wonky, you won't even be able to browser the MSDN site to look up technical details. You have to manually clear your cookies. Again.

View on HN

The most infuriating thing is that when logging on to live.com or its friends, they hook the tab key. When you type in your email, then tab over the next field, it redirects underneath you.

This infuriates me. It also really screws with people who can't touch type, and thus don't realize it's happened until they look up after entering their password only to realize the page changed and their text was lost.

I presume what's going on is the site realizes the login won't work and redirects you to the domain where it will, but it's just terrible design all around.

2 redirect? A dozen at least. And one website for the login, another for the password. Why do simple when one can write a piece of shit!

2 redirect minimum. I've seen quite a few more. The most I've seen in my history was 3 or 4, though.

In their defense based on your login it can push you to a different IDP to authenticate. In practice it's bad form to MiTM passwords for other systems, hence the password and login on different pages.

Flying Spaghetti Monster help you if you have both a personal and an organizational (Office 365) Microsoft account with the same email address.

For those of you who don't know, the process basically goes like this:

Input your email / password -> select if you want to use your personal or business profile -> enter your login info again (because, reasons) -> go through two redirects.

Until very recently, Comcast/Xfinity did something similar. On their landing page and logged out, one would click log in and enter their credentials, and the top bar shows you logged in. Click on the email link and you have to log in again. Click on the "My Account" link and log in again not once but twice, for a total of three logins to finally get there.

I think they fixed it about a month ago. I have my Comcast email forwarded to a real account on a domain I own so I never have to use their insane email system again, but I still have to log in to pay my bill. It's down to one login session now, but it's still a nightmare of a site to navigate.

HSBC's internet banking website is complete shit too. At least 2 redirects to login, and if you change your mind, the back button breaks the site completely until you manually go to the root again.

I appear to have a cookie set or something which makes the root of HSBC's site consistently 500 for me. At least the login still works.

Can't you pay by phone? That's how I deal with it on Optimum.

And if you're in some half logged in state it'll try to log you in to read public documentation, fail, and tell me a kb article is 404. I just use incognito mode, but have to go back to the google search first, as the new url is also broken. I swear they do stuff to make Chrome screw up, used to be that MS support pages didn't scroll properly in other browsers.

Meanwhile, Google authentication -- which begins at accounts.google.com -- often bounces through appengine.google.com, accounts.youtube.com, and other domains. Making apps for schools, it can be a bit dodgy explaining that the school needs to whitelist a YouTube url in order to use Google SSO.

Yes, I have always wondered why this happens the way it does. I haven't experiences being redirected through them, but it seems that on logon one is being randomly selected. They all are in the same 216.58.212.* subnet (now and here) but each have distinct IP-pairs.

Might it be some attempt to disspel censorship, such as the scenario you're describing?

On a slightly related note, I really hate that we Internet Citizens are convicted to using plaintext server name indication.

Isn't it for setting cookies not on the google.com domain?

I believe that's because they use some variant of OAuth for authentication, which necessarily involves "a bunch of redirects".

https://en.wikipedia.org/wiki/OAuth

Reply on news.ycombinator.com