We sign people in with an emailed link or a passkey. Both are better than a
password, and neither one works on a television.
A TV has no mail client to open the link in. It has no authenticator to hold the
passkey. It has a remote control instead of a keyboard. "Sign in on another
device" is not an answer when the TV is the device, so last month we added an
optional password: opt in, set only from inside a session you already have, no
reset flow at all. Forget it and you use the link, which still works.
Then we hid it.
The form went out on the sign-in page inside a collapsed disclosure, a grey "Use
a password" line you click to open. The code even carried a comment explaining
that the form belongs on the page rather than behind a toggle, "because a toggle
is one more thing to hit with a D-pad", and then wrapped it in exactly that.
The cost is not the extra click. On the device the form was built for, the page
shows two ways in that cannot be used there and one line of grey text with no
hint there is a form behind it. That does not read as "open this". It reads as
"this site has no password sign-in", and the person on the couch goes and finds
their phone.
We found it the way you find these things, which is by trying to sign in on a
TV.
So it is a plain section with a heading now, always visible. Nothing else moved.
The route, the argon2id hash, the rate limit counted since the last success, the
identical wording on every failure so the form cannot be used to check who has an
account: all unchanged. The error message still renders in the same place. The
only difference is that you can see the thing you are meant to type into.
Three sites share this code (tipoffwatch.com, watchnews.now, genrewatch.com) so
the fold shipped on all three and the fix went to all three.
The lesson we keep relearning is that a comment describing the right behaviour is
not the same as the behaviour. That one had been sitting directly above the
element contradicting it since the day it shipped, and it took a television to
notice.
This post was drafted with AI assistance.
Top comments (0)