Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The “Cobra Effect” that is disabling paste on password fields

troyhunt.com

Post reply on HN
Print view View original

101–110 of 450 posts

Re: The “Cobra Effect” that is disabling paste on password fields

#101

Post by twic »

mng2 wrote: post #59
morgante wrote: post #15

The worst is websites which not only disable pasting but don't even let you type your password in. Instead you have to use their janky on-screen keyboard to fumble your way through login. I got so fed up with TradeKing (which has horrible security practices in general) that I close my account.

HSBC has this really odd system where they only ask for the (e.g.) 1st, 6th, and 7th characters of your password. That implies that they store plaintext or something reversible...

The Co-operative Bank does this too. They absolutely store the password in plain text, because if you phone up, you have to tell the whole thing to the phone operator.

To be fair, they're right in the middle of rolling out a new banking site which I think has proper passwords. The current system is a holdover from when they only had phone banking.

Re: The “Cobra Effect” that is disabling paste on password fields

#102

Post by Twisell »

chjohasbrouck wrote: post #83
simbalion wrote: post #74

It always amazes me that someone is hired to implement strong security and they come up with things like paste-blocking. Or "security questions." Security questions are a social engineers best friend. Unless you're savvy and your answers are all strong passwords themselves, and if they are you're probably using keepass or something like it with 400+ bit passwords and you hate wasting time on security questions too.

It's amazing to me how insecure email is these days. If you know somebody's email, and you have a plausible reason to have a conversation with them, you can very easily take over their email account and reset the password on every account attached to it. I often wonder how much the security of email (and by extension, every other account online) depends on people just not knowing how simple and easy it is to break in…

This exactly why all my e-mail passwords are at least 18 character long with random generated gibberish stored on a keychain... And to secured that keychain I use a very long login password (XKCD style + numbers) that always make people cringe.

In return I assert a well deserved facepalm when I see a friend log in on his e-mail account with a variation of "Password1".

Re: The “Cobra Effect” that is disabling paste on password fields

#103

Post by jsn »

taneq wrote: post #97
StavrosK wrote: post #93

Earlier quoted context omitted.

You realize that this is trivial to brute force, though.

Not when they'd presumably lock the account for some period of time after a few failed attempts.

Password hashing is used to prevent the brute forcing when the attacker already has the copy of the password database, and is free from any failed attempt limits and timeouts. And in this case storing hashes of all 3-letter combos is basically useless, since all those hashes are very easy to bruteforce.

Re: The “Cobra Effect” that is disabling paste on password fields

#104

Post by JupiterMoon »

foz wrote: post #100

I believe that copy and paste is needed in login forms, as a UX expectation. Typing a secure random password is really painfully hard, especially on mobile. Sometimes password managers don't recognize the target form fields correctly, so copy/paste is the next step. The act is even encouraged through the use of convenient helper buttons in the password managers. However. In MacOs Sierra, Apple will introduce the Univ…

KeepassX on linux resets the buffer after 15 seconds.

Re: The “Cobra Effect” that is disabling paste on password fields

#105

Post by mmariani »

level3 wrote: post #5

I always assumed it was for the same reason sites make you enter your email address twice without pasting - to reduce the chance of mistyping. If you only have to enter something once, then you could easily mistype it and then you end up with an account you can't log in to or even recover. But if you have to type it twice, then the chance is greatly reduced, since you'd have to make the exact same typo twice in a row…

Somewhat related xkcd https://xkcd.com/970/

Re: The “Cobra Effect” that is disabling paste on password fields

#106

Post by Twisell »

Every time I see an apparently stupid security restriction reason I feel obligated to check if "Password1" is a valid entry...

You won't ever believe how often this work while gibberish keychain-generated passwords get rejected because they contain a "-" character ...

Wake up IT departments it can't always be users fault. People born with Window95 starts to work, they won't take your shady security reasons for granted as did people born in the 60's! They just will just think that your are incompetent...

Re: The “Cobra Effect” that is disabling paste on password fields

#107

Post by JupiterMoon »

mng2 wrote: post #59
morgante wrote: post #15

The worst is websites which not only disable pasting but don't even let you type your password in. Instead you have to use their janky on-screen keyboard to fumble your way through login. I got so fed up with TradeKing (which has horrible security practices in general) that I close my account.

HSBC has this really odd system where they only ask for the (e.g.) 1st, 6th, and 7th characters of your password. That implies that they store plaintext or something reversible...

On the other hand a publicised password leak from a major bank would be the end of the bank whether they stored passwords hashed or plaintext.

Re: The “Cobra Effect” that is disabling paste on password fields

#108

Post by askvictor »

fit2rule wrote: post #13

One reason to dissuade users from using the clipboard to paste passwords is this: the password stays in the clipboard. Not all users realize this, and so .. don't 'clear' the clipboard after logging in .. which means their password is still available to anyone else who might use that computer.

Lastpass is quite clever in that whenever you copy a password into clipboard, it clears the clipboard after a little time.

Re: The “Cobra Effect” that is disabling paste on password fields

#110

Post by ry_ry »

limelight wrote: post #30
level3 wrote: post #18

Earlier quoted context omitted.

As someone running a user-facing site, you cannot control whether your users use password managers. So what's your solution? Just disregard the segment of your users who don't use password managers? That's a tradeoff that you might not want to make, depending on your business. Also, if you're someone who uses a password manager, does disabling pasting really make you less secure? I assume you're still generating pass…

> Just disregard the segment of your users who don't use password managers? No, I recognize that most users probably don't use password managers. But I'm not convinced that disabling pasting helps much. For one thing, I don't actually think it's that common for someone to copy a mistyped password. Browsers disable copying from password fields, so they would have to type it in a third place and copy it into the fields…

You can get/set HTMLInputElement.value on [type="password"] anyway so if you wanted to shim the PW field copy/paste functionality back, you could just create a bookmarklet or something.

Edit, threw an example together. Ignore the horrible code ;P

Http://jsfiddle.net/6gc2d6hb

Type in one of the PW fields then double-click it. Doesn't overwrite populated PW fields.

Post reply on HN