Hacker News Reader

I've noticed many times the browser won't send those from the link. I was trying that with services where I owned both sides and my pre-authenticated links weren't sending the credentials. But using the same URL via curl was authenticated.

View on HN

On Firefox, I just get a warning: "You are about to log in to the site “news.ycombinator.com” with the username “test”"

I'm not entirely sure what the concern is to be honest. If it's tracking, this doesn't provide anything on top of query parameters e.g. ?utm_campaign=

The concern is about phishing via URL spoofing. For example, a user might see a URL like `google.com@mycoolphishingsite.se` and believe that "google.com" is the domain. The warning is intended to point out that "mycoolphishingsite.se" is the real domain.

I believe the major browsers deprecated this a little while ago. You can still use basic auth and everything, just not via a URL like this.

Reply on news.ycombinator.com