Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The “Cobra Effect” that is disabling paste on password fields

troyhunt.com

Post reply on HN
Print view View original

71–80 of 450 posts

Re: The “Cobra Effect” that is disabling paste on password fields

#71

Post by cheatdeath »

mng2 wrote: post #59
morgante wrote: post #15

The worst is websites which not only disable pasting but don't even let you type your password in. Instead you have to use their janky on-screen keyboard to fumble your way through login. I got so fed up with TradeKing (which has horrible security practices in general) that I close my account.

HSBC has this really odd system where they only ask for the (e.g.) 1st, 6th, and 7th characters of your password. That implies that they store plaintext or something reversible...

Presumably in case someone is watching you type in your details.

Re: The “Cobra Effect” that is disabling paste on password fields

#72

Post by duiker101 »

mng2 wrote: post #59
morgante wrote: post #15

The worst is websites which not only disable pasting but don't even let you type your password in. Instead you have to use their janky on-screen keyboard to fumble your way through login. I got so fed up with TradeKing (which has horrible security practices in general) that I close my account.

HSBC has this really odd system where they only ask for the (e.g.) 1st, 6th, and 7th characters of your password. That implies that they store plaintext or something reversible...

Lloyds UK has a system that I quite like, you have your credentials and then to login they ask you 3 random letters of another password that you select from 3 dropdowns. This way you have your password that is presumably secure, and you have this thing which is pretty fast to complete once you get used to it, that should help with people looking at you or keyloggers.

Re: The “Cobra Effect” that is disabling paste on password fields

#74

Post by simbalion »

It always amazes me that someone is hired to implement strong security and they come up with things like paste-blocking. Or "security questions." Security questions are a social engineers best friend. Unless you're savvy and your answers are all strong passwords themselves, and if they are you're probably using keepass or something like it with 400+ bit passwords and you hate wasting time on security questions too.

Re: The “Cobra Effect” that is disabling paste on password fields

#75

Post by fattire »

ohthehugemanate wrote: post #61
level3 wrote: post #5

I always assumed it was for the same reason sites make you enter your email address twice without pasting - to reduce the chance of mistyping. If you only have to enter something once, then you could easily mistype it and then you end up with an account you can't log in to or even recover. But if you have to type it twice, then the chance is greatly reduced, since you'd have to make the exact same typo twice in a row…

That doesn't make sense - where did the user copy the email/password from, in order to paste it in twice? Somewhere clear text, ergo easy to double check for typos or at least discover them after the fact. If you're worried about someone copy/pasting a typo, you should disable COPY on the field, not paste.

Yeah disabling copy makes more sense. I think the scenario is where you have to type your password 2x to avoid typos on a field where you can't see what you've just typed (to avoid shoulder surfers).. the first time the user types the password, then they highlight and ^C and then paste into the second field...

Re: The “Cobra Effect” that is disabling paste on password fields

#76

Post by simbalion »

level3 wrote: post #31
raldi wrote: post #20

Earlier quoted context omitted.

> So what's your solution? Allow pasted passwords if they meet a very high password-quality heuristic; deny them if they seem too guessable.

How is that a solution to the problem of user error (i.e. mistyping)? Are you making an implicit assumption about password manager use and mistyping, that somehow your heuristic will be able to differentiate? That seems like a lot of work for something that may be prone to mistakes, while also delivering an inconsistent user experience, for the sake of some (unstated) assumptions about security that may not be founde…

there is no solution for user error. give up on that dream right away.

isolate the users so they cannot destroy your system when they get hacked, because they will always get hacked.

Re: The “Cobra Effect” that is disabling paste on password fields

#78

Post by simbalion »

Khaine wrote: post #64

Any web developer who does this should be shot. Same with silently dropping characters from passwords when signing up and poor validation of email addresses

that seems a bit extreme I think you could just fire them and hire a better developer, then they might learn their lesson.

Re: The “Cobra Effect” that is disabling paste on password fields

#79

Post by dave2000 »

ohthehugemanate wrote: post #61
level3 wrote: post #5

I always assumed it was for the same reason sites make you enter your email address twice without pasting - to reduce the chance of mistyping. If you only have to enter something once, then you could easily mistype it and then you end up with an account you can't log in to or even recover. But if you have to type it twice, then the chance is greatly reduced, since you'd have to make the exact same typo twice in a row…

That doesn't make sense - where did the user copy the email/password from, in order to paste it in twice? Somewhere clear text, ergo easy to double check for typos or at least discover them after the fact. If you're worried about someone copy/pasting a typo, you should disable COPY on the field, not paste.

I guess it's possible to have an app which lets you click or enter a number and it populates the clipboard with the password.

I like the idea of two factor input; enter/select a password on a phone and send it over WiFi to the pc to paste into the field. Does this exist?

Re: The “Cobra Effect” that is disabling paste on password fields

#80

Post by Retr0spectrum »

madeofpalk wrote: post #17
morgante wrote: post #12

Earlier quoted context omitted.

That's still not a very good reason. If you're security conscious, you shouldn't be typing passwords at all. You should generate them from a password manager and paste them into the field both times. It boils down to security theater making us all less secure.

Not concerned about security, but about the direct user experience. The user won't know that they've mistyped their password, won't potentially won't return when they can't log into their account.

Why not just disallow copying from the first field?

That way, password manager users can paste into both fields, but users who are hand-typing are forced to avoid mistakes.

Post reply on HN