Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The “Cobra Effect” that is disabling paste on password fields

troyhunt.com

Post reply on HN
Print view View original

131–140 of 450 posts

Re: The “Cobra Effect” that is disabling paste on password fields

#131

Post by MereInterest »

pm wrote: post #51
morgante wrote: post #34

Earlier quoted context omitted.

> I'm not sure what their line of thought it; It's theoretically a defense against key loggers. Of course, if someone has compromised your machine to the point where they're tracking key strokes there's no reason to assume they can't also grab your mouse presses and websites. This isn't even their worst security practice. What truly got me to leave was their security questions: they're presented as multiple choices.…

This is where convenience trumps security. Virgin Money used to require you to enter your password using an on-screen keyboard, except they REARRANGED THE LAYOUT EVERYTIME YOU USED IT. Thank fuck they eventually got rid of it, but it was such an abject pain in the ass, I cringed everytime I needed to log in to view my details.

I wouldn't even call it a trade-off between convenience and security, because there is no security gained. This is a trade-off between convenience and stupidity. If someone suspects that a keylogger is there, the entire computer should be assumed to be compromised. Trying to guess the capabilities of the keylogger and working around them is ludicrous.

Re: The “Cobra Effect” that is disabling paste on password fields

#132

Post by nothrowaway »

fakemeatsubs wrote: post #68
nothrowaway wrote: post #55

If it helps anyone, this Chrome extension has worked every time I've tried it: https://github.com/jswanner/DontFuckWithPaste (I usually keep it disabled, but enable it when I'm about to use a site that has paste disabled on any fields.)

Awesome, is there a similar one for selecting text and copying?

Very possibly, but I don't know of one to recommend, sorry.

(Temporarily disabling JavaScript is sometimes an option.)

Re: The “Cobra Effect” that is disabling paste on password fields

#133

Post by signal11 »

mng2 wrote: post #59
morgante wrote: post #15

The worst is websites which not only disable pasting but don't even let you type your password in. Instead you have to use their janky on-screen keyboard to fumble your way through login. I got so fed up with TradeKing (which has horrible security practices in general) that I close my account.

HSBC has this really odd system where they only ask for the (e.g.) 1st, 6th, and 7th characters of your password. That implies that they store plaintext or something reversible...

HSBC doesn't do that any more for me -- they've moved to a Google Authenticator-like 2FA approach[1], but Lloyds[2] does - they have one username and password, and a "memorable phrase" which they clearly store as plaintext because ask for the xth, yth and zth character as a secondary security measure. Lloyds tech folk reading this -- please consider fixing this.

[1] http://i.imgur.com/QCGPDWz.png [2] http://i.imgur.com/VdtGC4T.png

Re: The “Cobra Effect” that is disabling paste on password fields

#134

Post by darkhorn »

In Turkey there must be law which says that mobile carriers must cooperate with banks because when I enter my ID and my first password to the web page of the bank it says "oups! it appears that you have changed your SIM card, please re-validate yourself before we SMS you a 2fa password".

And in Bulgaria I saw use of client-side certificates.

Re: The “Cobra Effect” that is disabling paste on password fields

#135

Post by wtracz »

mng2 wrote: post #59
morgante wrote: post #15

The worst is websites which not only disable pasting but don't even let you type your password in. Instead you have to use their janky on-screen keyboard to fumble your way through login. I got so fed up with TradeKing (which has horrible security practices in general) that I close my account.

HSBC has this really odd system where they only ask for the (e.g.) 1st, 6th, and 7th characters of your password. That implies that they store plaintext or something reversible...

They can use Shamir's Secret Sharing to achieve this with no plaintext.

see http://willtracz.co.uk/shamir-secret-sharing-and-passwords

Re: The “Cobra Effect” that is disabling paste on password fields

#136

Post by Tenoke »

signal11 wrote: post #133
mng2 wrote: post #59

Earlier quoted context omitted.

HSBC has this really odd system where they only ask for the (e.g.) 1st, 6th, and 7th characters of your password. That implies that they store plaintext or something reversible...

HSBC doesn't do that any more for me -- they've moved to a Google Authenticator-like 2FA approach[1], but Lloyds[2] does - they have one username and password, and a "memorable phrase" which they clearly store as plaintext because ask for the xth, yth and zth character as a secondary security measure. Lloyds tech folk reading this -- please consider fixing this. [1] http://i.imgur.com/QCGPDWz.png [2] http://i.imgur.c…

Same for Natwest, but this does not mean they store it in plain-text.

Re: The “Cobra Effect” that is disabling paste on password fields

#137

Post by chris_wot »

makomk wrote: post #114
mng2 wrote: post #59

Earlier quoted context omitted.

HSBC has this really odd system where they only ask for the (e.g.) 1st, 6th, and 7th characters of your password. That implies that they store plaintext or something reversible...

Yes. This is to protect against attackers obtaining your full plaintext password on your end, for example by phishing or installing keyloggers. In practice this is a much bigger security threat in the online banking world than someone doing the same by compromising the bank's systems - even if that were to happen they can easily re-verify your identity and issue you with a new password, and you really shouldn't be us…

How does this prevent key logging attacks? You still type in those characters. And secondly, that just immediately made it a hell of a lot easier to brute force your way through the passwords!

Re: The “Cobra Effect” that is disabling paste on password fields

#138

Post by robbbbbbbbb »

im3w1l wrote: post #54
morgante wrote: post #35

Earlier quoted context omitted.

Why though? A .txt file on the desktop is actually probably a lot more secure than using the same shitty password on every site.

A friend may get tempted to sneak a peek.

Your friend could just as easily install a keylogger and get everything anyway.

Re: The “Cobra Effect” that is disabling paste on password fields

#139

Post by bbotond »

chjohasbrouck wrote: post #83
simbalion wrote: post #74

It always amazes me that someone is hired to implement strong security and they come up with things like paste-blocking. Or "security questions." Security questions are a social engineers best friend. Unless you're savvy and your answers are all strong passwords themselves, and if they are you're probably using keepass or something like it with 400+ bit passwords and you hate wasting time on security questions too.

It's amazing to me how insecure email is these days. If you know somebody's email, and you have a plausible reason to have a conversation with them, you can very easily take over their email account and reset the password on every account attached to it. I often wonder how much the security of email (and by extension, every other account online) depends on people just not knowing how simple and easy it is to break in…

Could you give an example of how it is possible to take over an email account just by having an e-mail conversation with the owner?

Re: The “Cobra Effect” that is disabling paste on password fields

#140

Post by CarolineW »

Although relevant, this dates from 2014. It's been submitted a few times, although the only time it got any discussion was here:

https://news.ycombinator.com/item?id=7832938

There were 33 comments on that submission, so that discussion might be relevant. I wonder if this discussion repeats any of the points made there ...

Post reply on HN