Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The “Cobra Effect” that is disabling paste on password fields

troyhunt.com

Post reply on HN
Print view View original

31–40 of 450 posts

Re: The “Cobra Effect” that is disabling paste on password fields

#31

Post by level3 »

raldi wrote: post #20
level3 wrote: post #18

Earlier quoted context omitted.

As someone running a user-facing site, you cannot control whether your users use password managers. So what's your solution? Just disregard the segment of your users who don't use password managers? That's a tradeoff that you might not want to make, depending on your business. Also, if you're someone who uses a password manager, does disabling pasting really make you less secure? I assume you're still generating pass…

> So what's your solution? Allow pasted passwords if they meet a very high password-quality heuristic; deny them if they seem too guessable.

How is that a solution to the problem of user error (i.e. mistyping)? Are you making an implicit assumption about password manager use and mistyping, that somehow your heuristic will be able to differentiate? That seems like a lot of work for something that may be prone to mistakes, while also delivering an inconsistent user experience, for the sake of some (unstated) assumptions about security that may not be founded.

Re: The “Cobra Effect” that is disabling paste on password fields

#32

Post by BinaryIdiot »

astrodust wrote: post #23
khattam wrote: post #16

>Sometimes you want to use the same credentials on multiple domains of the same service and auto-fill only works against the domain the pattern was recorded on. That's why you should use Lastpass.

I've tried to use Lastpass but that thing needs a UX enema because it's atrociously bad.

Oh good so I'm not alone! I tried setting it up but trying to mass import multiple passwords from KeePass over (which doesn't translate directly 1 to 1) left me manually entering them. The process was so incredibly slow and cumbersome that I gave up. It doesn't help that LastPass looks like it was created in 2003 by developers with zero UX / design talent.

I hope they can improve that one day.

Re: The “Cobra Effect” that is disabling paste on password fields

#34

Post by morgante »

BinaryIdiot wrote: post #26
morgante wrote: post #15

The worst is websites which not only disable pasting but don't even let you type your password in. Instead you have to use their janky on-screen keyboard to fumble your way through login. I got so fed up with TradeKing (which has horrible security practices in general) that I close my account.

> don't even let you type your password in. Instead you have to use their janky on-screen keyboard to fumble your way through login. Wow that's just insane. I'm glad I haven't run across any services like that. I'm not sure what their line of thought it; it only inconveniences normal users. A person attempting to try multiple passwords can likely figure out how to get around that restriction without issue.

> I'm not sure what their line of thought it;

It's theoretically a defense against key loggers. Of course, if someone has compromised your machine to the point where they're tracking key strokes there's no reason to assume they can't also grab your mouse presses and websites.

This isn't even their worst security practice. What truly got me to leave was their security questions: they're presented as multiple choices. My randomly generated string stands out rather obviously next to the "typical" choices.

Re: The “Cobra Effect” that is disabling paste on password fields

#35

Post by morgante »

dandelany wrote: post #33

Not that I think it's a good reason, but I think the rationale behind disabling paste is to prevent users from implementing their own "password managers" via a .txt file full of passwords on their Desktop (more common than you'd think).

Why though?

A .txt file on the desktop is actually probably a lot more secure than using the same shitty password on every site.

Re: The “Cobra Effect” that is disabling paste on password fields

#36

Post by ioquatix »

morgante wrote: post #12
level3 wrote: post #5

I always assumed it was for the same reason sites make you enter your email address twice without pasting - to reduce the chance of mistyping. If you only have to enter something once, then you could easily mistype it and then you end up with an account you can't log in to or even recover. But if you have to type it twice, then the chance is greatly reduced, since you'd have to make the exact same typo twice in a row…

That's still not a very good reason. If you're security conscious, you shouldn't be typing passwords at all. You should generate them from a password manager and paste them into the field both times. It boils down to security theater making us all less secure.

If you are security conscious at all, you'd be generating a public/private key pair for website authentication, only using HTTPS and potentially preferring TOR. I mean, a username+password field is SO FAR from good security practices, it's almost a joke.

Re: The “Cobra Effect” that is disabling paste on password fields

#37

Post by iancarroll »

morgante wrote: post #15

The worst is websites which not only disable pasting but don't even let you type your password in. Instead you have to use their janky on-screen keyboard to fumble your way through login. I got so fed up with TradeKing (which has horrible security practices in general) that I close my account.

This one at least makes some sort of sense; it's designed to prevent keyloggers from reading your password when you type it in. You can just MiTM the connection though.

Re: The “Cobra Effect” that is disabling paste on password fields

#38

Post by justaboy21 »

lisivka wrote: post #19
fit2rule wrote: post #13

One reason to dissuade users from using the clipboard to paste passwords is this: the password stays in the clipboard. Not all users realize this, and so .. don't 'clear' the clipboard after logging in .. which means their password is still available to anyone else who might use that computer.

So, login form can just clear clipboard instead in onsubmit() handler.

You can't alter the clipboard from JS (you can on browsers that support the execCommand API but still).

Re: The “Cobra Effect” that is disabling paste on password fields

#39

Post by limelight »

level3 wrote: post #31
raldi wrote: post #20

Earlier quoted context omitted.

> So what's your solution? Allow pasted passwords if they meet a very high password-quality heuristic; deny them if they seem too guessable.

How is that a solution to the problem of user error (i.e. mistyping)? Are you making an implicit assumption about password manager use and mistyping, that somehow your heuristic will be able to differentiate? That seems like a lot of work for something that may be prone to mistakes, while also delivering an inconsistent user experience, for the sake of some (unstated) assumptions about security that may not be founde…

It actually makes a lot of sense.

People will almost never manually type out high security (>20 random characters) passwords themselves. So if someone enters a high entropy password, you can fairly confident that mistyping is not an issue.

Re: The “Cobra Effect” that is disabling paste on password fields

#40

Post by level3 »

limelight wrote: post #30
level3 wrote: post #18

Earlier quoted context omitted.

As someone running a user-facing site, you cannot control whether your users use password managers. So what's your solution? Just disregard the segment of your users who don't use password managers? That's a tradeoff that you might not want to make, depending on your business. Also, if you're someone who uses a password manager, does disabling pasting really make you less secure? I assume you're still generating pass…

> Just disregard the segment of your users who don't use password managers? No, I recognize that most users probably don't use password managers. But I'm not convinced that disabling pasting helps much. For one thing, I don't actually think it's that common for someone to copy a mistyped password. Browsers disable copying from password fields, so they would have to type it in a third place and copy it into the fields…

That's a fair point that in general, password fields aren't copyable.

So I do think that retyping passwords has value, but disabling pasting may have questionable value. (In my experience, disabling pasting on email confirmation fields does reduce the rate of error there, since lots of people copy-paste)

Post reply on HN