On OSX using Hammerspoon to type from the clipboard into whatever for you has been a life-saver for me.
Especially ever since Apple disabled pasting for decrypting external drives.
The “Cobra Effect” that is disabling paste on password fields
21–30 of 450 posts
Re: The “Cobra Effect” that is disabling paste on password fields
#22Windows doesn't let you paste when changing your password either. It's annoying.
Re: The “Cobra Effect” that is disabling paste on password fields
#23>Sometimes you want to use the same credentials on multiple domains of the same service and auto-fill only works against the domain the pattern was recorded on. That's why you should use Lastpass.
I've tried to use Lastpass but that thing needs a UX enema because it's atrociously bad.
Re: The “Cobra Effect” that is disabling paste on password fields
#24One reason to dissuade users from using the clipboard to paste passwords is this: the password stays in the clipboard. Not all users realize this, and so .. don't 'clear' the clipboard after logging in .. which means their password is still available to anyone else who might use that computer.
I've written short Powershell functions that watch your clipboard and send it over UDP to a remote Powershell session. Does your favorite Powershell module have something similar? It could simply load with Powershell and start logging your clipboard.
Re: The “Cobra Effect” that is disabling paste on password fields
#25One reason to dissuade users from using the clipboard to paste passwords is this: the password stays in the clipboard. Not all users realize this, and so .. don't 'clear' the clipboard after logging in .. which means their password is still available to anyone else who might use that computer.
That seems like an incredibly weak argument: if an attacker has physical access to the machine, all bets are off. How do you know that there wasn't anything installed to MITM everything already?
Re: The “Cobra Effect” that is disabling paste on password fields
#26The worst is websites which not only disable pasting but don't even let you type your password in. Instead you have to use their janky on-screen keyboard to fumble your way through login. I got so fed up with TradeKing (which has horrible security practices in general) that I close my account.
> don't even let you type your password in. Instead you have to use their janky on-screen keyboard to fumble your way through login.
Wow that's just insane. I'm glad I haven't run across any services like that. I'm not sure what their line of thought it; it only inconveniences normal users. A person attempting to try multiple passwords can likely figure out how to get around that restriction without issue.
Re: The “Cobra Effect” that is disabling paste on password fields
#27Until better minds prevail.., Disable JavaScript, paste password, enable JavaScript, login. A pain, but usually effective.
Re: The “Cobra Effect” that is disabling paste on password fields
#28Luckily middle click paste on unix seems to bypass everything. It doesn't trigger not copy events (so the website can't mess with the text), nor paste events. Just the way it should be.
The article outlined a way for websites to check this: count the number of key press events (filtering modifiers of course) and the number of characters. Or you can imagine a particularly asinine site performing some statistical analyses on your keystroke timing (flight time and dwell time) and even deduce whether it's typed by a human or not. The thing is, this is a policy issue, not a technological issue.
If it's JavaScript, you can script that out in your client.
Honestly there's no reason to do this bullshit of disallowing pasting client-side. If pasting is a problem, if your machine is compromised, it's got a key-logger too.
Those on-screen keyboards to try and foil that vector basically presumes everyone's infected, and so, encourages weak passwords that are more likely to be brute-forced by an adversary not using that interface.
Re: The “Cobra Effect” that is disabling paste on password fields
#29Luckily middle click paste on unix seems to bypass everything. It doesn't trigger not copy events (so the website can't mess with the text), nor paste events. Just the way it should be.
The article outlined a way for websites to check this: count the number of key press events (filtering modifiers of course) and the number of characters. Or you can imagine a particularly asinine site performing some statistical analyses on your keystroke timing (flight time and dwell time) and even deduce whether it's typed by a human or not. The thing is, this is a policy issue, not a technological issue.
You can always solve this technologically, though, as long as the code powering their nonsense checks runs on hardware physically under your control. There are no javascript commands, only javascript suggestions.
Re: The “Cobra Effect” that is disabling paste on password fields
#30Earlier quoted context omitted.
That's still not a very good reason. If you're security conscious, you shouldn't be typing passwords at all. You should generate them from a password manager and paste them into the field both times. It boils down to security theater making us all less secure.
As someone running a user-facing site, you cannot control whether your users use password managers. So what's your solution? Just disregard the segment of your users who don't use password managers? That's a tradeoff that you might not want to make, depending on your business. Also, if you're someone who uses a password manager, does disabling pasting really make you less secure? I assume you're still generating pass…
> Just disregard the segment of your users who don't use password managers?
No, I recognize that most users probably don't use password managers. But I'm not convinced that disabling pasting helps much.
For one thing, I don't actually think it's that common for someone to copy a mistyped password. Browsers disable copying from password fields, so they would have to type it in a third place and copy it into the fields from there. Most users are not sophisticated enough to do that.
> Also, if you're someone who uses a password manager, does disabling pasting really make you less secure?
It directly encourages people to use less secure passwords. If I try to manually retype a 50 character password myself, I'm very likely to make an error. This isn't theoretical—I've often purposefully lowered the complexity of passwords for sites with these kind of arbitrary restrictions.
It's too bad 1Password doesn't have an auto-type feature.