Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The “Cobra Effect” that is disabling paste on password fields

troyhunt.com

Post reply on HN
Print view View original

201–210 of 450 posts

Re: The “Cobra Effect” that is disabling paste on password fields

#201

Post by Dylan16807 »

level3 wrote: post #44
limelight wrote: post #39

Earlier quoted context omitted.

It actually makes a lot of sense. People will almost never manually type out high security (>20 random characters) passwords themselves. So if someone enters a high entropy password, you can fairly confident that mistyping is not an issue.

I'm not quit convinced about that. 1) Aren't there people using generators like Diceware that don't do the password management part? 2) The industry's definition of "high security" is constantly changing. Password strength measurement makes assumptions about what is and isn't guessable, and a lot of that depends on what techniques the common brute-force crackers are employing. So finding the right heuristic is also p…

The nice thing about password generators is that you can have a huge margin of strength for free. Keepass defaults to 119 bit passwords. Require 100 estimated bits and you'll blow manual passwords out of the water.

Re: The “Cobra Effect” that is disabling paste on password fields

#202

Post by cosecantt »

jsn wrote: post #103
taneq wrote: post #97

Earlier quoted context omitted.

Not when they'd presumably lock the account for some period of time after a few failed attempts.

Password hashing is used to prevent the brute forcing when the attacker already has the copy of the password database, and is free from any failed attempt limits and timeouts. And in this case storing hashes of all 3-letter combos is basically useless, since all those hashes are very easy to bruteforce.

Can't it be achieved by this simple steps? Consider ur password is y. a) f(y, i) = a func that gets i'th character of a pass. y; b) hash(x) is ur hashing func; c) x0 = hash(y); d) concat(a, b) - concatination func; 1. x1 = hash(concat(f(y,1), x0)); 2. x2 = hash(concat(f(y,2)+x0)); . . etc

Store in DB id position hash user_id 1 0 x0 1 2 1 x1 1 3 2 x2 1

Re: The “Cobra Effect” that is disabling paste on password fields

#203

Post by ebiester »

Khaine wrote: post #64

Any web developer who does this should be shot. Same with silently dropping characters from passwords when signing up and poor validation of email addresses

In my experience, the developer is protesting furiously but has a rent payment and quit on the spot.

Re: The “Cobra Effect” that is disabling paste on password fields

#204

Post by Retric »

hk__2 wrote: post #193
megalodon wrote: post #185

Earlier quoted context omitted.

This is what we use here in Sweden as well. The reason it works is that all inhabitants are given a personal identification number upon birth, that consists of our birthday + 4 digits which are loosely based on where we are born and if we are male/female. This number is unique for every person and is used to register to the BankID service (among other things) and ensures that it is connected to a single individual.

> The reason it works is that all inhabitants are given a personal identification number upon birth Isn’t that the same as the Social Security/National Insurance number you get in various countries? In France you have a unique number that depends on your sex, where you’re born, 3 more digits to differentiate you from all other people of the same sex that were born the same day at the same place and then a final digit…

SSN's in the US are not unique, though they are only used by one person at a time.

Re: The “Cobra Effect” that is disabling paste on password fields

#205

Post by cosecantt »

hartator wrote: post #182
cosecantt wrote: post #179

Earlier quoted context omitted.

I do not agree that they store a password in plain text. You cannot say for sure. What if they hash each character and store each with its position in the db?

That wouldnbe still pain text actually, because it's easy to have a table for hash -> char. Chararcters being limited by their numbers.

Fine. Refer to my detailed answer below that shows longer hashing difficult to bruteforce.

Re: The “Cobra Effect” that is disabling paste on password fields

#206

Post by rsync »

chjohasbrouck wrote: post #83
simbalion wrote: post #74

It always amazes me that someone is hired to implement strong security and they come up with things like paste-blocking. Or "security questions." Security questions are a social engineers best friend. Unless you're savvy and your answers are all strong passwords themselves, and if they are you're probably using keepass or something like it with 400+ bit passwords and you hate wasting time on security questions too.

It's amazing to me how insecure email is these days. If you know somebody's email, and you have a plausible reason to have a conversation with them, you can very easily take over their email account and reset the password on every account attached to it. I often wonder how much the security of email (and by extension, every other account online) depends on people just not knowing how simple and easy it is to break in…

"If you know somebody's email, and you have a plausible reason to have a conversation with them, you can very easily take over their email account and reset the password on every account attached to it."

Not if they self provide their own email (by running their own mailserver).

Re: The “Cobra Effect” that is disabling paste on password fields

#207

Post by kybernetikos »

MereInterest wrote: post #124
makomk wrote: post #114

Earlier quoted context omitted.

Yes. This is to protect against attackers obtaining your full plaintext password on your end, for example by phishing or installing keyloggers. In practice this is a much bigger security threat in the online banking world than someone doing the same by compromising the bank's systems - even if that were to happen they can easily re-verify your identity and issue you with a new password, and you really shouldn't be us…

Phishing is a much bigger security threat, but is a much less harmful one than having the password database stolen. It sounds like they are trying to minimize the day-to-day risks, at the expense of maximize the damage of a catastrophic event.

All the systems I've used that do this make you have two passwords, only one of which they are storing in a reversible way.

Re: The “Cobra Effect” that is disabling paste on password fields

#208

Post by rsync »

nothrowaway wrote: post #55

If it helps anyone, this Chrome extension has worked every time I've tried it: https://github.com/jswanner/DontFuckWithPaste (I usually keep it disabled, but enable it when I'm about to use a site that has paste disabled on any fields.)

"If it helps anyone, this Chrome extension has worked every time I've tried it: https://github.com/jswanner/DontFuckWithPaste"

Shouldn't chrome itself be a "don't fuck with paste" tool ?

As the world moves to the browser as the OS (essentially) it's imperative that the browser respect end user wishes and behave as a sentry against malicious websites and malicious website behavior.

Re: The “Cobra Effect” that is disabling paste on password fields

#209

Post by icedchai »

Retric wrote: post #204
hk__2 wrote: post #193

Earlier quoted context omitted.

> The reason it works is that all inhabitants are given a personal identification number upon birth Isn’t that the same as the Social Security/National Insurance number you get in various countries? In France you have a unique number that depends on your sex, where you’re born, 3 more digits to differentiate you from all other people of the same sex that were born the same day at the same place and then a final digit…

SSN's in the US are not unique, though they are only used by one person at a time.

Are you telling me SSN numbers are actually recycled? I don't believe you.

Re: The “Cobra Effect” that is disabling paste on password fields

#210

Post by mtmail »

Retric wrote: post #204
hk__2 wrote: post #193

Earlier quoted context omitted.

> The reason it works is that all inhabitants are given a personal identification number upon birth Isn’t that the same as the Social Security/National Insurance number you get in various countries? In France you have a unique number that depends on your sex, where you’re born, 3 more digits to differentiate you from all other people of the same sex that were born the same day at the same place and then a final digit…

SSN's in the US are not unique, though they are only used by one person at a time.

"The Social Security Administration does not reuse Social Security numbers" https://en.wikipedia.org/wiki/Social_Security_number#Exhaust...
Post reply on HN