Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The “Cobra Effect” that is disabling paste on password fields

troyhunt.com

Post reply on HN
Print view View original

51–60 of 450 posts

Re: The “Cobra Effect” that is disabling paste on password fields

#51

Post by pm »

morgante wrote: post #34
BinaryIdiot wrote: post #26

Earlier quoted context omitted.

> don't even let you type your password in. Instead you have to use their janky on-screen keyboard to fumble your way through login. Wow that's just insane. I'm glad I haven't run across any services like that. I'm not sure what their line of thought it; it only inconveniences normal users. A person attempting to try multiple passwords can likely figure out how to get around that restriction without issue.

> I'm not sure what their line of thought it; It's theoretically a defense against key loggers. Of course, if someone has compromised your machine to the point where they're tracking key strokes there's no reason to assume they can't also grab your mouse presses and websites. This isn't even their worst security practice. What truly got me to leave was their security questions: they're presented as multiple choices.…

This is where convenience trumps security. Virgin Money used to require you to enter your password using an on-screen keyboard, except they REARRANGED THE LAYOUT EVERYTIME YOU USED IT. Thank fuck they eventually got rid of it, but it was such an abject pain in the ass, I cringed everytime I needed to log in to view my details.

Re: The “Cobra Effect” that is disabling paste on password fields

#52

Post by _0w8t »

iancarroll wrote: post #37
morgante wrote: post #15

The worst is websites which not only disable pasting but don't even let you type your password in. Instead you have to use their janky on-screen keyboard to fumble your way through login. I got so fed up with TradeKing (which has horrible security practices in general) that I close my account.

This one at least makes some sort of sense; it's designed to prevent keyloggers from reading your password when you type it in. You can just MiTM the connection though.

Modern keyloggers track mouse and take screenshots on clicks.

Re: The “Cobra Effect” that is disabling paste on password fields

#53

Post by XorNot »

morgante wrote: post #42
ioquatix wrote: post #36

Earlier quoted context omitted.

If you are security conscious at all, you'd be generating a public/private key pair for website authentication, only using HTTPS and potentially preferring TOR. I mean, a username+password field is SO FAR from good security practices, it's almost a joke.

I assume you're being farcical, but I would love if more sites offered authentication schemes beyond usernames and passwords. These days, I will refuse to log in to any website which doesn't support https.

I'd like APIs to automate rolling my passwords. Ideally keepass expires it, gives me a list and let's me day "go" and be automatically updates them all.

Re: The “Cobra Effect” that is disabling paste on password fields

#54

Post by im3w1l »

morgante wrote: post #35
dandelany wrote: post #33

Not that I think it's a good reason, but I think the rationale behind disabling paste is to prevent users from implementing their own "password managers" via a .txt file full of passwords on their Desktop (more common than you'd think).

Why though? A .txt file on the desktop is actually probably a lot more secure than using the same shitty password on every site.

A friend may get tempted to sneak a peek.

Re: The “Cobra Effect” that is disabling paste on password fields

#56

Post by bruce_one »

_0w8t wrote: post #52
iancarroll wrote: post #37

Earlier quoted context omitted.

This one at least makes some sort of sense; it's designed to prevent keyloggers from reading your password when you type it in. You can just MiTM the connection though.

Modern keyloggers track mouse and take screenshots on clicks.

I know of some of those sites that randomise the location of keys and then hide the key labels on mousedown, I assume to try and avert that issue.

(Curious as to whether it would actually work though.)

Re: The “Cobra Effect” that is disabling paste on password fields

#58

Post by TheSmiddy »

bruce_one wrote: post #56
_0w8t wrote: post #52

Earlier quoted context omitted.

Modern keyloggers track mouse and take screenshots on clicks.

I know of some of those sites that randomise the location of keys and then hide the key labels on mousedown, I assume to try and avert that issue. (Curious as to whether it would actually work though.)

A hacker can get around that by also taking a screenshot when there is no mousedown event, it's literally one extra line of code.

Re: The “Cobra Effect” that is disabling paste on password fields

#59

Post by mng2 »

morgante wrote: post #15

The worst is websites which not only disable pasting but don't even let you type your password in. Instead you have to use their janky on-screen keyboard to fumble your way through login. I got so fed up with TradeKing (which has horrible security practices in general) that I close my account.

HSBC has this really odd system where they only ask for the (e.g.) 1st, 6th, and 7th characters of your password. That implies that they store plaintext or something reversible...

Re: The “Cobra Effect” that is disabling paste on password fields

#60

Post by elsurudo »

mng2 wrote: post #59
morgante wrote: post #15

The worst is websites which not only disable pasting but don't even let you type your password in. Instead you have to use their janky on-screen keyboard to fumble your way through login. I got so fed up with TradeKing (which has horrible security practices in general) that I close my account.

HSBC has this really odd system where they only ask for the (e.g.) 1st, 6th, and 7th characters of your password. That implies that they store plaintext or something reversible...

Not necessarily – they could be hash + salting multiple permutations
Post reply on HN