Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The “Cobra Effect” that is disabling paste on password fields

troyhunt.com

Post reply on HN
Print view View original

121–130 of 450 posts

Re: The “Cobra Effect” that is disabling paste on password fields

#121

Post by happyslobro »

ry_ry wrote: post #110
limelight wrote: post #30

Earlier quoted context omitted.

> Just disregard the segment of your users who don't use password managers? No, I recognize that most users probably don't use password managers. But I'm not convinced that disabling pasting helps much. For one thing, I don't actually think it's that common for someone to copy a mistyped password. Browsers disable copying from password fields, so they would have to type it in a third place and copy it into the fields…

You can get/set HTMLInputElement.value on [type="password"] anyway so if you wanted to shim the PW field copy/paste functionality back, you could just create a bookmarklet or something. Edit, threw an example together. Ignore the horrible code ;P Http://jsfiddle.net/6gc2d6hb Type in one of the PW fields then double-click it. Doesn't overwrite populated PW fields.

And once again, we find ourselves inspecting elements to fix someone's brilliant idea.

Re: The “Cobra Effect” that is disabling paste on password fields

#122

Post by semi-extrinsic »

reitanqild wrote: post #113
duiker101 wrote: post #72

Earlier quoted context omitted.

Lloyds UK has a system that I quite like, you have your credentials and then to login they ask you 3 random letters of another password that you select from 3 dropdowns. This way you have your password that is presumably secure, and you have this thing which is pretty fast to complete once you get used to it, that should help with people looking at you or keyloggers.

Around here every bank require 2fa for logon and then again for signing payments (although you can queue and batch sign a number at a time. )

Barclays in the UK does 2fa if you order it, otherwise this strange bit with just parts of the password.

They also have the most complicated 2fa I've seen. You get a pocket-calculator-like device where you need to insert your card (chip and pin type), then you enter your personal code, and then you do a challenge-response thing where you enter a code generated from the website into the device, and it responds with a number you have to type into the website.

They also have this anti-paste function that was triggered by me typing too fast.

Re: The “Cobra Effect” that is disabling paste on password fields

#123

Post by makomk »

Retr0spectrum wrote: post #80
madeofpalk wrote: post #17

Earlier quoted context omitted.

Not concerned about security, but about the direct user experience. The user won't know that they've mistyped their password, won't potentially won't return when they can't log into their account.

Why not just disallow copying from the first field? That way, password manager users can paste into both fields, but users who are hand-typing are forced to avoid mistakes.

Sites already do, but that doesn't stop users from copy-and-pasting from password generators or typing the password elsewhere and copy-and-pasting that twice.

Re: The “Cobra Effect” that is disabling paste on password fields

#124

Post by MereInterest »

makomk wrote: post #114
mng2 wrote: post #59

Earlier quoted context omitted.

HSBC has this really odd system where they only ask for the (e.g.) 1st, 6th, and 7th characters of your password. That implies that they store plaintext or something reversible...

Yes. This is to protect against attackers obtaining your full plaintext password on your end, for example by phishing or installing keyloggers. In practice this is a much bigger security threat in the online banking world than someone doing the same by compromising the bank's systems - even if that were to happen they can easily re-verify your identity and issue you with a new password, and you really shouldn't be us…

Phishing is a much bigger security threat, but is a much less harmful one than having the password database stolen. It sounds like they are trying to minimize the day-to-day risks, at the expense of maximize the damage of a catastrophic event.

Re: The “Cobra Effect” that is disabling paste on password fields

#125

Post by happyslobro »

lisivka wrote: post #19
fit2rule wrote: post #13

One reason to dissuade users from using the clipboard to paste passwords is this: the password stays in the clipboard. Not all users realize this, and so .. don't 'clear' the clipboard after logging in .. which means their password is still available to anyone else who might use that computer.

So, login form can just clear clipboard instead in onsubmit() handler.

Hopefully there is nothing important in the clipbkard, like some data that the user will attempt to submit a second time after logging in. It sounded like a good idea at first, but now I want my +1 back :p

Re: The “Cobra Effect” that is disabling paste on password fields

#126

Post by khattam »

onion2k wrote: post #43
khattam wrote: post #16

>Sometimes you want to use the same credentials on multiple domains of the same service and auto-fill only works against the domain the pattern was recorded on. That's why you should use Lastpass.

That assumes the user has a choice. Many corporate environments don't let users install software so Lastpass isn't an option.

Why is anything else an option then?

Re: The “Cobra Effect” that is disabling paste on password fields

#127

Post by MereInterest »

OJFord wrote: post #111
yk wrote: post #95

Earlier quoted context omitted.

The problem is, if you have a bunch of partial passwords 1, 2, 3; 1, 2, 4; ... you can just brute force three character combinations of the passwords, which just takes something half a second (times the number of rounds) if you write your password cracker in bash. So your complexity goes from 52^n for a n character password consisting of lower and upper case to n/3* 52^3 which is a lot more manageable.

But three strikes and your out - out to the physical bank with proof of ID to change it.

You're assuming that the verification is being done by the bank itself. This is under the assumption that there has already been a security breach. The password database has been stolen, and has just been sold to the highest bidder. In that case, there is no lockout.

Re: The “Cobra Effect” that is disabling paste on password fields

#128

Post by happyslobro »

I have a crazy idea: what if we held people responsible for their own mistakes, instead of turning the world into a padded room? You messed up your password? Reset it. You have a virus / XSS that is slurping the clipboard? It's probably logging keystrokes too, and that's not the devs problem (well, XSS is, but blocking paste isn't the solution)

Re: The “Cobra Effect” that is disabling paste on password fields

#129

Post by bbcbasic »

dhoe wrote: post #120
bluejekyll wrote: post #7

Earlier quoted context omitted.

Developers don't need to be mindless code punchers. They can be thoughtful individuals who say, "that's dumb", and then have a discussion with the PM on why that is dumb. On the other hand, maybe development of software is a mindless endevour, and so the labor in this area must be cheap, right?!

You're right, of course, but it's also true that in a real life environment, you've already found a polite way to say "that's dumb" three times this morning and you're starting to pick your battles.

This! Dilbert is a documentary not a cartoon. Devs work for businessfolk. Businessfolk have the control call the shots. Sure they'll listen to devs but get the final say.

Re: The “Cobra Effect” that is disabling paste on password fields

#130

Post by Retr0spectrum »

makomk wrote: post #123
Retr0spectrum wrote: post #80

Earlier quoted context omitted.

Why not just disallow copying from the first field? That way, password manager users can paste into both fields, but users who are hand-typing are forced to avoid mistakes.

Sites already do, but that doesn't stop users from copy-and-pasting from password generators or typing the password elsewhere and copy-and-pasting that twice.

Enabling the use of password managers is a good thing.

A user typing the password elsewhere probably means they were able to see it while they type, and are therefore less likely to make a mistake.

Post reply on HN