The “Cobra Effect” that is disabling paste on password fields
1–10 of 450 posts
Re: The “Cobra Effect” that is disabling paste on password fields
#2Great article. The only point missed is that password length limits AND re-type fields AND disabling copy and paste are all measures that when, implemented correctly, are supposed to help you remember your password and prevent easy access to reset mechanisms by forcing you to type it twice and not accidentally copy and paste it twice.
Of course, in an era where weak password re-use and leaked hashes are one of the biggest problems facing normal internet users, we really should re-evaluate all the above assumptions.
Or if it's too hard, let email providers handle the login security requirements... Since most places allow email-based password resets anyway.
Re: The “Cobra Effect” that is disabling paste on password fields
#3Disagree that it's a conscious decision on the developers' part. Developers get told to do this, so they do.
Re: The “Cobra Effect” that is disabling paste on password fields
#4Fortunately, it's not hard to get around this on desktop (for Mac at least) with an applet like Paste Typer. But when I see this on iOS it infuriates me. I use 1Password to generate strong (long) passwords and having to type them out manually is a huge PIA.
Re: The “Cobra Effect” that is disabling paste on password fields
#5I always assumed it was for the same reason sites make you enter your email address twice without pasting - to reduce the chance of mistyping. If you only have to enter something once, then you could easily mistype it and then you end up with an account you can't log in to or even recover. But if you have to type it twice, then the chance is greatly reduced, since you'd have to make the exact same typo twice in a row.
Edit: This is regarding account creation/changes like the PayPal example. I have no idea why login forms would disallow pasting.
Re: The “Cobra Effect” that is disabling paste on password fields
#6Luckily middle click paste on unix seems to bypass everything.
It doesn't trigger not copy events (so the website can't mess with the text), nor paste events. Just the way it should be.
Re: The “Cobra Effect” that is disabling paste on password fields
#7Disagree that it's a conscious decision on the developers' part. Developers get told to do this, so they do.
Developers don't need to be mindless code punchers. They can be thoughtful individuals who say, "that's dumb", and then have a discussion with the PM on why that is dumb.
On the other hand, maybe development of software is a mindless endevour, and so the labor in this area must be cheap, right?!
Re: The “Cobra Effect” that is disabling paste on password fields
#8Fortunately, it's not hard to get around this on desktop (for Mac at least) with an applet like Paste Typer. But when I see this on iOS it infuriates me. I use 1Password to generate strong (long) passwords and having to type them out manually is a huge PIA.
On Android, KeePassDroid registers as a keyboard to prevent other apps from retrieving your passwords from the clipboard. Not super familiar with iOS, but it seems like a good practice anyway, independent of its utility in circumventing asinine "no pasting" policies.
Re: The “Cobra Effect” that is disabling paste on password fields
#9Luckily middle click paste on unix seems to bypass everything. It doesn't trigger not copy events (so the website can't mess with the text), nor paste events. Just the way it should be.
I feel like I'm missing a GUI-limb when I'm on Windows and don't have the highlight buffer/middle-click paste...
Re: The “Cobra Effect” that is disabling paste on password fields
#10Luckily middle click paste on unix seems to bypass everything. It doesn't trigger not copy events (so the website can't mess with the text), nor paste events. Just the way it should be.
The article outlined a way for websites to check this: count the number of key press events (filtering modifiers of course) and the number of characters. Or you can imagine a particularly asinine site performing some statistical analyses on your keystroke timing (flight time and dwell time) and even deduce whether it's typed by a human or not. The thing is, this is a policy issue, not a technological issue.