Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The “Cobra Effect” that is disabling paste on password fields

troyhunt.com

Post reply on HN
Print view View original

81–90 of 450 posts

Re: The “Cobra Effect” that is disabling paste on password fields

#81

Post by LoSboccacc »

morgante wrote: post #34
BinaryIdiot wrote: post #26

Earlier quoted context omitted.

> don't even let you type your password in. Instead you have to use their janky on-screen keyboard to fumble your way through login. Wow that's just insane. I'm glad I haven't run across any services like that. I'm not sure what their line of thought it; it only inconveniences normal users. A person attempting to try multiple passwords can likely figure out how to get around that restriction without issue.

> I'm not sure what their line of thought it; It's theoretically a defense against key loggers. Of course, if someone has compromised your machine to the point where they're tracking key strokes there's no reason to assume they can't also grab your mouse presses and websites. This isn't even their worst security practice. What truly got me to leave was their security questions: they're presented as multiple choices.…

Yeah it's stairs and ladders. One I saw also randomized the position of numbers on the keypad, so you need now also to track that.

Which is pointless anyway because at the point you access the keyboard buffer you can as well install a certificate and get a proxy going

Re: The “Cobra Effect” that is disabling paste on password fields

#82

Post by wila »

Khaine wrote: post #64

Any web developer who does this should be shot. Same with silently dropping characters from passwords when signing up and poor validation of email addresses

Nah, they simply should take away the developer's own paste functionality so that they can no longer paste code from websites. ;)

Re: The “Cobra Effect” that is disabling paste on password fields

#83

Post by chjohasbrouck »

simbalion wrote: post #74

It always amazes me that someone is hired to implement strong security and they come up with things like paste-blocking. Or "security questions." Security questions are a social engineers best friend. Unless you're savvy and your answers are all strong passwords themselves, and if they are you're probably using keepass or something like it with 400+ bit passwords and you hate wasting time on security questions too.

It's amazing to me how insecure email is these days. If you know somebody's email, and you have a plausible reason to have a conversation with them, you can very easily take over their email account and reset the password on every account attached to it.

I often wonder how much the security of email (and by extension, every other account online) depends on people just not knowing how simple and easy it is to break into. If everyone knew, we'd be living in chaos right now, right?

Re: The “Cobra Effect” that is disabling paste on password fields

#84

Post by LoSboccacc »

morgante wrote: post #42
ioquatix wrote: post #36

Earlier quoted context omitted.

If you are security conscious at all, you'd be generating a public/private key pair for website authentication, only using HTTPS and potentially preferring TOR. I mean, a username+password field is SO FAR from good security practices, it's almost a joke.

I assume you're being farcical, but I would love if more sites offered authentication schemes beyond usernames and passwords. These days, I will refuse to log in to any website which doesn't support https.

Once we had a chance to push openid to internet.... Now that would have been convenient. At least more are working toward google, twitter and facebook oauth, so a majority of services I use has no password at all.

Re: The “Cobra Effect” that is disabling paste on password fields

#85

Post by waterhouse »

dandelany wrote: post #33

Not that I think it's a good reason, but I think the rationale behind disabling paste is to prevent users from implementing their own "password managers" via a .txt file full of passwords on their Desktop (more common than you'd think).

I have a method of generating passwords from a cryptographic hash of a secret key and the name of a service. This has been defeated by several services that forbid me from using the resulting passwords, either because of their special-character requirements or password lengths (after encountering some of this, I prefix the output with "A1a" and cut it off at 16 characters, but I've used services where even that isn't good enough), or because they want me to change my password every N days and don't allow me to reuse passwords.

I submit, I give up, you win. There's a file called "plaintext-passwords.txt" in my home directory. I keep the account information for these services in there. I've thought of keeping it encrypted, but if they don't want my account to be secure, why should I?

Anyway, if I had to type these passwords in rather than paste them, that would not stop me. All it might do is incentivize me to make them shorter.

Re: The “Cobra Effect” that is disabling paste on password fields

#86

Post by Tharkun »

khattam wrote: post #16

>Sometimes you want to use the same credentials on multiple domains of the same service and auto-fill only works against the domain the pattern was recorded on. That's why you should use Lastpass.

Lastpass is horrible. And IIRC someone posted a proof of concept attack a while back which looked exactly like the LP password dialog but instead stole your credentials.

Re: The “Cobra Effect” that is disabling paste on password fields

#88

Post by DroidX86 »

mng2 wrote: post #59
morgante wrote: post #15

The worst is websites which not only disable pasting but don't even let you type your password in. Instead you have to use their janky on-screen keyboard to fumble your way through login. I got so fed up with TradeKing (which has horrible security practices in general) that I close my account.

HSBC has this really odd system where they only ask for the (e.g.) 1st, 6th, and 7th characters of your password. That implies that they store plaintext or something reversible...

They could be extracting the 1st, 6th and 7th characters, concat them and storing the hash (+salt) of the resulting string. That way they can check equality without storing the plaintext password.

You could extend this by storing the hash of all 3-letter combinations of the password on entry. Then ask for a random combination of 3-letters.

Re: The “Cobra Effect” that is disabling paste on password fields

#89

Post by dingo_bat »

markcerqueira wrote: post #4

Fortunately, it's not hard to get around this on desktop (for Mac at least) with an applet like Paste Typer. But when I see this on iOS it infuriates me. I use 1Password to generate strong (long) passwords and having to type them out manually is a huge PIA.

I have a Microsoft touch mouse, and I can program macros on the touchpad's regions. So if I press the top/middle part of the thing, it just types my password :)

In fact, now that I'm thinking of it, I can use it to trigger a script which will type whatever is in the clipboard. Silly javascript script kiddies think they can control a user's behavior like this.

Re: The “Cobra Effect” that is disabling paste on password fields

#90

Post by dingo_bat »

Spydar007 wrote: post #22

Windows doesn't let you paste when changing your password either. It's annoying.

Windows doesn't let you paste whenever you are in one of those 'elevated' contexts, like the login screen. In fact, this prevents my nifty mouse macros from running too.
Post reply on HN