General
We hid the login form we built for televisions
0 views

We sign people in with an emailed link or a passkey. Both are better than a
password, and neither one works on a television.
A TV has no mail client to open the link in. It has no authenticator to hold the
passkey. It has a remote control instead of a keyboard. "Sign in on another
device" is not an answer when the TV is the device, so last month we added an
optional password: opt in, set only from inside a session you already have, no
reset flow at all. Forget it and you use the link, which still works.
Then we hid it.
The form went out on the sign-in page inside a collapsed disclosure, a grey "Use
a password" line you click to open. The code even carried a comment explaining
that the form belongs on the page rather than behind a toggle, "because a toggle
is one more thing to hit with a D-pad", and then wrapped it in exactly that.
The cost is not the extra click. On the device the form was built for, the page
shows two ways in that cannot be used there and one line of grey text with no
hint there is a form behind it. That does not read as "open this". It reads as
"this site has no password sign-in", and the person on the couch goes and finds
their phone.
We found it the way you find these things, which is by trying to sign in on a
TV.
So it is a plain section with a heading now, always visible. Nothing else moved.
The route, the argon2id hash, the rate limit counted since the last success, the
identical wording on every failure so the form cannot be used to check who has an
account: all unchanged. The error message still renders in the same place. The
only difference is that you can see the thing you are meant to type into.
Three sites share this code (tipoffwatch.com, watchnews.now, genrewatch.com) so
the fold shipped on all three and the fix went to all three.
The lesson we keep relearning is that a comment describing the right behaviour is
not the same as the behaviour. That one had been sitting directly above the
element contradicting it since the day it shipped, and it took a television to
notice.
This post was drafted with AI assistance.
Read original: https://dev.to/chovy/we-hid-the-login-form-we-built-for-televisions-4cod
PreviousWe gave our AI agent fleet a credit limit, and it hit it the same dayNextWe let an AI write SQL against customer databases. Here is every guardrail, and why prompting is not one.
Related posts
Recognizing Keystrokes Using WiFi Devices
0Lobsters
Polyend releases the Tracker firmware source code
0Lobsters
eli venn
0Lobsters

16GB Raspberry Pi 5 hiked to $385, more than triple its launch price — makers are already shifting to Pico/ESP32 for small projects, mini PCs for more ambitious tasks
0Tom's Hardware
The Trump Administration Is Wreaking Havoc on the Electoral System Before the Midterms
0Wired

YouTuber Druski is going to make exclusive content for Netflix
0The Verge