Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The “Cobra Effect” that is disabling paste on password fields

troyhunt.com

Post reply on HN
Print view View original

111–120 of 450 posts

Re: The “Cobra Effect” that is disabling paste on password fields

#111

Post by OJFord »

yk wrote: post #95
wlievens wrote: post #73

Earlier quoted context omitted.

The 1, 6, 7 is random

The problem is, if you have a bunch of partial passwords 1, 2, 3; 1, 2, 4; ... you can just brute force three character combinations of the passwords, which just takes something half a second (times the number of rounds) if you write your password cracker in bash. So your complexity goes from 52^n for a n character password consisting of lower and upper case to n/3* 52^3 which is a lot more manageable.

But three strikes and your out - out to the physical bank with proof of ID to change it.

Re: The “Cobra Effect” that is disabling paste on password fields

#112

Post by pje »

alimw wrote: post #87

Is it really necessary to portray an initiative to wipe out dangerous snakes as self-interested and imperialist?

He never described the _initiative_ as imperialist, just the British rulers. Since the British rule of colonial India is virtually the dictionary definition of imperialism, I'll go ahead and call the author's word choice reasonable.

Re: The “Cobra Effect” that is disabling paste on password fields

#113

Post by reitanqild »

duiker101 wrote: post #72
mng2 wrote: post #59

Earlier quoted context omitted.

HSBC has this really odd system where they only ask for the (e.g.) 1st, 6th, and 7th characters of your password. That implies that they store plaintext or something reversible...

Lloyds UK has a system that I quite like, you have your credentials and then to login they ask you 3 random letters of another password that you select from 3 dropdowns. This way you have your password that is presumably secure, and you have this thing which is pretty fast to complete once you get used to it, that should help with people looking at you or keyloggers.

Around here every bank require 2fa for logon and then again for signing payments (although you can queue and batch sign a number at a time. )

Re: The “Cobra Effect” that is disabling paste on password fields

#114

Post by makomk »

mng2 wrote: post #59
morgante wrote: post #15

The worst is websites which not only disable pasting but don't even let you type your password in. Instead you have to use their janky on-screen keyboard to fumble your way through login. I got so fed up with TradeKing (which has horrible security practices in general) that I close my account.

HSBC has this really odd system where they only ask for the (e.g.) 1st, 6th, and 7th characters of your password. That implies that they store plaintext or something reversible...

Yes. This is to protect against attackers obtaining your full plaintext password on your end, for example by phishing or installing keyloggers. In practice this is a much bigger security threat in the online banking world than someone doing the same by compromising the bank's systems - even if that were to happen they can easily re-verify your identity and issue you with a new password, and you really shouldn't be using the same password elsewhere.

Re: The “Cobra Effect” that is disabling paste on password fields

#115

Post by oolongCat »

Twisell wrote: post #102
chjohasbrouck wrote: post #83

Earlier quoted context omitted.

It's amazing to me how insecure email is these days. If you know somebody's email, and you have a plausible reason to have a conversation with them, you can very easily take over their email account and reset the password on every account attached to it. I often wonder how much the security of email (and by extension, every other account online) depends on people just not knowing how simple and easy it is to break in…

This exactly why all my e-mail passwords are at least 18 character long with random generated gibberish stored on a keychain... And to secured that keychain I use a very long login password (XKCD style + numbers) that always make people cringe. In return I assert a well deserved facepalm when I see a friend log in on his e-mail account with a variation of "Password1".

That sounds like a very tedious thing to go through to login to your email.

Just use a strong password ( https://xkcd.com/936/ )

The funny thing with having email as a username is, how sometimes people can use social engineering to gain control of your account, non of that fancy "hoaxer" stuff are needed when your service providers put untrained people in charge of your accounts. Hacking human stupidity is a more effective way in to get in to a secure system.

( as an example, this was on reddit just yesterday https://www.youtube.com/watch?v=lc7scxvKQOo )

Re: The “Cobra Effect” that is disabling paste on password fields

#116

Post by MichaelBurge »

I could see it having at least some benefit if you not only disabled paste, but tracked the individual letters as they were typed in. It'd give you a little statistical information, like how Google watches how you click a checkbox for a captcha.

But it seems like an actual captcha would be better, then.

Re: The “Cobra Effect” that is disabling paste on password fields

#117

Post by TazeTSchnitzel »

Disabling paste on changing password strikes me as a good idea. If you're not pasting from a password manager, it's easy to accidentally select additional whitespace or miss the first or last character. If you then paste it, you end up with a different password than you thought.

But for login, I see no reason to prevent it.

Re: The “Cobra Effect” that is disabling paste on password fields

#118

Post by [deleted] »

twic wrote: post #101
mng2 wrote: post #59

Earlier quoted context omitted.

HSBC has this really odd system where they only ask for the (e.g.) 1st, 6th, and 7th characters of your password. That implies that they store plaintext or something reversible...

The Co-operative Bank does this too. They absolutely store the password in plain text, because if you phone up, you have to tell the whole thing to the phone operator. To be fair, they're right in the middle of rolling out a new banking site which I think has proper passwords. The current system is a holdover from when they only had phone banking.

[deleted]

Re: The “Cobra Effect” that is disabling paste on password fields

#119

Post by happyslobro »

TazeTSchnitzel wrote: post #117

Disabling paste on changing password strikes me as a good idea. If you're not pasting from a password manager, it's easy to accidentally select additional whitespace or miss the first or last character. If you then paste it, you end up with a different password than you thought. But for login, I see no reason to prevent it.

What? The password comes from the password manager in the first place! Please people, do not break shit just to protect me from my own sloppy mistakes.

Re: The “Cobra Effect” that is disabling paste on password fields

#120

Post by dhoe »

bluejekyll wrote: post #7
draw_down wrote: post #3

Disagree that it's a conscious decision on the developers' part. Developers get told to do this, so they do.

Developers don't need to be mindless code punchers. They can be thoughtful individuals who say, "that's dumb", and then have a discussion with the PM on why that is dumb. On the other hand, maybe development of software is a mindless endevour, and so the labor in this area must be cheap, right?!

You're right, of course, but it's also true that in a real life environment, you've already found a polite way to say "that's dumb" three times this morning and you're starting to pick your battles.
Post reply on HN