Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The “Cobra Effect” that is disabling paste on password fields

troyhunt.com

Post reply on HN
Print view View original

191–200 of 450 posts

Re: The “Cobra Effect” that is disabling paste on password fields

#191

Post by happyslobro »

konschubert wrote: post #158
happyslobro wrote: post #128

I have a crazy idea: what if we held people responsible for their own mistakes, instead of turning the world into a padded room? You messed up your password? Reset it. You have a virus / XSS that is slurping the clipboard? It's probably logging keystrokes too, and that's not the devs problem (well, XSS is, but blocking paste isn't the solution)

I agree that the security theater is annoying, and uselsess, but I think you are drawing the wrong conclusion. Sometime in the 1960s we realized that we can't reduce fatal car accidents by "holding people accountable for their own mistakes". We actually have to make cars safer.

That's different, people can't learn from fatal accidents. They do learn not to ignore the "check oil" indicator though, we don't need to disable the engine to make people pay attention to that. This is acceptable, even if it costs the occasional fool an engine.

Re: The “Cobra Effect” that is disabling paste on password fields

#192

Post by dogma1138 »

coldtea wrote: post #168
k-mcgrady wrote: post #147

Earlier quoted context omitted.

It asks for different characters from the password each time. So it'll ask for the 1st, 4th, and 5th characters. Next time you go to login it'll ask from 2nd, 8th, 14th. So a key logger is only getting a small portion of the password each time.

So they attacker just has to run the keylogger for enough time...

The attacker needs to both be able to read the page and key log every keystroke and be able to associate as single letter, digit, or symbol to you password and not only that to the correct placement within the password. This is virtually impossible to achieve by any effective means. They ask random characters from your password in a random order if you login into your bank twice a week it most likely will a year or more until a some one can phish your entire password from you this is not scaleable.

Re: The “Cobra Effect” that is disabling paste on password fields

#193

Post by hk__2 »

megalodon wrote: post #185
tyfon wrote: post #180

Here in Norway, almost all financial and government institutions allow a form of authentication called BankID ( https://www.bankid.no/en/company/ ). I use the mobile variant and it works for all government related stuff like taxes, health, relocation notices and also with all banks both when logging in and paying bills, signing contracts etc. It is a legally binding identification akin to signing a paper. The procedu…

This is what we use here in Sweden as well. The reason it works is that all inhabitants are given a personal identification number upon birth, that consists of our birthday + 4 digits which are loosely based on where we are born and if we are male/female. This number is unique for every person and is used to register to the BankID service (among other things) and ensures that it is connected to a single individual.

> The reason it works is that all inhabitants are given a personal identification number upon birth

Isn’t that the same as the Social Security/National Insurance number you get in various countries? In France you have a unique number that depends on your sex, where you’re born, 3 more digits to differentiate you from all other people of the same sex that were born the same day at the same place and then a final digit for a checksum.

Re: The “Cobra Effect” that is disabling paste on password fields

#194

Post by dogma1138 »

signal11 wrote: post #133
mng2 wrote: post #59

Earlier quoted context omitted.

HSBC has this really odd system where they only ask for the (e.g.) 1st, 6th, and 7th characters of your password. That implies that they store plaintext or something reversible...

HSBC doesn't do that any more for me -- they've moved to a Google Authenticator-like 2FA approach[1], but Lloyds[2] does - they have one username and password, and a "memorable phrase" which they clearly store as plaintext because ask for the xth, yth and zth character as a secondary security measure. Lloyds tech folk reading this -- please consider fixing this. [1] http://i.imgur.com/QCGPDWz.png [2] http://i.imgur.c…

HSBC always used a token for online banking you can either order a secure Key or for the past year or so use a mobile authenticator.

The "password/memorable phrase" is only used as a secondary authentication measure and in order to initiate a token recovery procedure on the site.

P.S. I still use the physical OTP token, just got a new one last month it's a Vasco Digitpass 270 supports upto 8 digit pins and it locks out automatically after IIRC 5 attempts.

I don't recommend using a phone authenticator for the sole reason that losing a phone is annoying enough on it's own you don't want to lose your bank account access too :)

Re: The “Cobra Effect” that is disabling paste on password fields

#195

Post by Dylan16807 »

OJFord wrote: post #111
yk wrote: post #95

Earlier quoted context omitted.

The problem is, if you have a bunch of partial passwords 1, 2, 3; 1, 2, 4; ... you can just brute force three character combinations of the passwords, which just takes something half a second (times the number of rounds) if you write your password cracker in bash. So your complexity goes from 52^n for a n character password consisting of lower and upper case to n/3* 52^3 which is a lot more manageable.

But three strikes and your out - out to the physical bank with proof of ID to change it.

That defense also works for plaintext passwords.

Tell me why plaintext password storage is bad, and you'll defeat your own argument.

Re: The “Cobra Effect” that is disabling paste on password fields

#196

Post by happyslobro »

tirant wrote: post #157
happyslobro wrote: post #128

I have a crazy idea: what if we held people responsible for their own mistakes, instead of turning the world into a padded room? You messed up your password? Reset it. You have a virus / XSS that is slurping the clipboard? It's probably logging keystrokes too, and that's not the devs problem (well, XSS is, but blocking paste isn't the solution)

Why do you want to punish people even more instead of trying to educate them and help them? You and me probably do not make mistakes in this subject: but we have to admit we are both lucky and got enough education/insights to be able to handle security 'right'. Most of the population are not that lucky.

Forcing users to type out passwords does not educate them, or even encourage good habits. All it does is frustrate people who already have good password management habits, and encourage those who don't to keep (re-)using passwords that are easy to remember and quick to type.

Re: The “Cobra Effect” that is disabling paste on password fields

#198

Post by megalodon »

hk__2 wrote: post #193
megalodon wrote: post #185

Earlier quoted context omitted.

This is what we use here in Sweden as well. The reason it works is that all inhabitants are given a personal identification number upon birth, that consists of our birthday + 4 digits which are loosely based on where we are born and if we are male/female. This number is unique for every person and is used to register to the BankID service (among other things) and ensures that it is connected to a single individual.

> The reason it works is that all inhabitants are given a personal identification number upon birth Isn’t that the same as the Social Security/National Insurance number you get in various countries? In France you have a unique number that depends on your sex, where you’re born, 3 more digits to differentiate you from all other people of the same sex that were born the same day at the same place and then a final digit…

You are probably right, I added that part in because I read somewhere that not all countries maintain lists of personal identities as comprehensive but that might have been a long time ago, in that case my mistake.

For more info: https://en.wikipedia.org/wiki/Personal_identity_number_(Swed...

Re: The “Cobra Effect” that is disabling paste on password fields

#199

Post by guiambros »

tyfon wrote: post #180

Here in Norway, almost all financial and government institutions allow a form of authentication called BankID ( https://www.bankid.no/en/company/ ). I use the mobile variant and it works for all government related stuff like taxes, health, relocation notices and also with all banks both when logging in and paying bills, signing contracts etc. It is a legally binding identification akin to signing a paper. The procedu…

> ... you get a popup on the phone (via the gsm network and sim toolkit, not ip)

What about customers who are traveling overseas, or live in a different country?

Re: The “Cobra Effect” that is disabling paste on password fields

#200

Post by bbotond »

Merad wrote: post #169
bbotond wrote: post #139

Earlier quoted context omitted.

Could you give an example of how it is possible to take over an email account just by having an e-mail conversation with the owner?

I imagine he/she is referring to how most "security questions" use info that we typically don't hesitate to give out in casual conversation, even with total strangers.

Man I hate those security questions with a passion. They are super weakly protected backdoors into your account.

Here's how I deal with sites that require them:

site: "What is your first teacher's name?"

me: "'Fx|The answer is a password equivalent, so I just treat it like a password.

Post reply on HN