Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The “Cobra Effect” that is disabling paste on password fields

troyhunt.com

Post reply on HN
Print view View original

61–70 of 450 posts

Re: The “Cobra Effect” that is disabling paste on password fields

#61

Post by ohthehugemanate »

level3 wrote: post #5

I always assumed it was for the same reason sites make you enter your email address twice without pasting - to reduce the chance of mistyping. If you only have to enter something once, then you could easily mistype it and then you end up with an account you can't log in to or even recover. But if you have to type it twice, then the chance is greatly reduced, since you'd have to make the exact same typo twice in a row…

That doesn't make sense - where did the user copy the email/password from, in order to paste it in twice? Somewhere clear text, ergo easy to double check for typos or at least discover them after the fact. If you're worried about someone copy/pasting a typo, you should disable COPY on the field, not paste.

Re: The “Cobra Effect” that is disabling paste on password fields

#62

Post by ohthehugemanate »

BinaryIdiot wrote: post #32
astrodust wrote: post #23

Earlier quoted context omitted.

I've tried to use Lastpass but that thing needs a UX enema because it's atrociously bad.

Oh good so I'm not alone! I tried setting it up but trying to mass import multiple passwords from KeePass over (which doesn't translate directly 1 to 1) left me manually entering them. The process was so incredibly slow and cumbersome that I gave up. It doesn't help that LastPass looks like it was created in 2003 by developers with zero UX / design talent. I hope they can improve that one day.

When did you try it? It very recently went through a total ux overhaul. Big improvement imo.

Re: The “Cobra Effect” that is disabling paste on password fields

#63

Post by Strilanc »

elsurudo wrote: post #60
mng2 wrote: post #59

Earlier quoted context omitted.

HSBC has this really odd system where they only ask for the (e.g.) 1st, 6th, and 7th characters of your password. That implies that they store plaintext or something reversible...

Not necessarily – they could be hash + salting multiple permutations

No amount of salting is going to make a 3-character recognizer secure.

Re: The “Cobra Effect” that is disabling paste on password fields

#66

Post by juliendorra »

ioquatix wrote: post #36
morgante wrote: post #12

Earlier quoted context omitted.

That's still not a very good reason. If you're security conscious, you shouldn't be typing passwords at all. You should generate them from a password manager and paste them into the field both times. It boils down to security theater making us all less secure.

If you are security conscious at all, you'd be generating a public/private key pair for website authentication, only using HTTPS and potentially preferring TOR. I mean, a username+password field is SO FAR from good security practices, it's almost a joke.

Interestingly, the french taxation department used to require you to identify on their website using a certificate, starting in the early 2000s.

A few years ago they dropped this requirement and you can now login using just an email and password.

The certificate-based identification process was really bad UI-wise so going with passwords probably helped them get more people to interact online instead of via paper forms.

Re: The “Cobra Effect” that is disabling paste on password fields

#67

Post by level3 »

ohthehugemanate wrote: post #61
level3 wrote: post #5

I always assumed it was for the same reason sites make you enter your email address twice without pasting - to reduce the chance of mistyping. If you only have to enter something once, then you could easily mistype it and then you end up with an account you can't log in to or even recover. But if you have to type it twice, then the chance is greatly reduced, since you'd have to make the exact same typo twice in a row…

That doesn't make sense - where did the user copy the email/password from, in order to paste it in twice? Somewhere clear text, ergo easy to double check for typos or at least discover them after the fact. If you're worried about someone copy/pasting a typo, you should disable COPY on the field, not paste.

If you've ever run a website that doesn't verify email addresses, you will likely run into this problem. The average person doesn't double check for typos, and they can't discover it after the fact because they didn't notice the typo in the first place, and you won't be able to contact them to inform them.

Your suggestion of disabling copy instead of paste may be a better solution, though.

Re: The “Cobra Effect” that is disabling paste on password fields

#68

Post by fakemeatsubs »

nothrowaway wrote: post #55

If it helps anyone, this Chrome extension has worked every time I've tried it: https://github.com/jswanner/DontFuckWithPaste (I usually keep it disabled, but enable it when I'm about to use a site that has paste disabled on any fields.)

Awesome, is there a similar one for selecting text and copying?

Re: The “Cobra Effect” that is disabling paste on password fields

#70

Post by [deleted] »

elsurudo wrote: post #60
mng2 wrote: post #59

Earlier quoted context omitted.

HSBC has this really odd system where they only ask for the (e.g.) 1st, 6th, and 7th characters of your password. That implies that they store plaintext or something reversible...

Not necessarily – they could be hash + salting multiple permutations

[deleted]
Post reply on HN