Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The “Cobra Effect” that is disabling paste on password fields

troyhunt.com

Post reply on HN
Print view View original

211–220 of 450 posts

Re: The “Cobra Effect” that is disabling paste on password fields

#211

Post by Tepix »

simbalion wrote: post #74

It always amazes me that someone is hired to implement strong security and they come up with things like paste-blocking. Or "security questions." Security questions are a social engineers best friend. Unless you're savvy and your answers are all strong passwords themselves, and if they are you're probably using keepass or something like it with 400+ bit passwords and you hate wasting time on security questions too.

United MileagePlus just switched to security questions that only allow multiple choice answers. Some of the questions only have 12 valid answers. Compare that with even a weak password! Unbelievable.

Re: The “Cobra Effect” that is disabling paste on password fields

#212

Post by Tepix »

bbotond wrote: post #200
Merad wrote: post #169

Earlier quoted context omitted.

I imagine he/she is referring to how most "security questions" use info that we typically don't hesitate to give out in casual conversation, even with total strangers.

Man I hate those security questions with a passion. They are super weakly protected backdoors into your account. Here's how I deal with sites that require them: site: "What is your first teacher's name?" me: "'Fx| The answer is a password equivalent, so I just treat it like a password.

Doesn't work with United MileagePlus accounts, they only allow multiple choice answers!

Re: The “Cobra Effect” that is disabling paste on password fields

#213

Post by Tepix »

kuschku wrote: post #174
chjohasbrouck wrote: post #83

Earlier quoted context omitted.

It's amazing to me how insecure email is these days. If you know somebody's email, and you have a plausible reason to have a conversation with them, you can very easily take over their email account and reset the password on every account attached to it. I often wonder how much the security of email (and by extension, every other account online) depends on people just not knowing how simple and easy it is to break in…

And that’s why I host all my email myself, and have my VPS with no password login (only key auth), and have 2FA enabled for the VPS control panel at the hoster, and have 2FA enabled for any change to the domain requiring a letter to be sent to me.

You should use a dedicated server instead of a VPS if you're concerned about privacy.

Re: The “Cobra Effect” that is disabling paste on password fields

#214

Post by sundvor »

Tharkun wrote: post #86
khattam wrote: post #16

>Sometimes you want to use the same credentials on multiple domains of the same service and auto-fill only works against the domain the pattern was recorded on. That's why you should use Lastpass.

Lastpass is horrible. And IIRC someone posted a proof of concept attack a while back which looked exactly like the LP password dialog but instead stole your credentials.

Which is why one should always 2FA.

Re: The “Cobra Effect” that is disabling paste on password fields

#215

Post by iamphilrae »

phlo wrote: post #172
BinaryIdiot wrote: post #26

Earlier quoted context omitted.

> don't even let you type your password in. Instead you have to use their janky on-screen keyboard to fumble your way through login. Wow that's just insane. I'm glad I haven't run across any services like that. I'm not sure what their line of thought it; it only inconveniences normal users. A person attempting to try multiple passwords can likely figure out how to get around that restriction without issue.

It's a valid defense against hardware keyloggers, ignoring that you're way more likely to encounter a software keylogger. If your account is interesting enough for criminals to break into your computer room and attach dongles to your PC (I'm imagining a Mission: Impossible style break here), congratulations: you've clearly made some good financial decisions in life :-)

Not unrealistic to assume a scenario where a disgruntled IT technician installs countless hardware key loggers throughout an open plan office. Could be easier and less noticeable than trying to circumvent the business-grade antivirus.

Re: The “Cobra Effect” that is disabling paste on password fields

#216

Post by wbkang »

megalodon wrote: post #185
tyfon wrote: post #180

Here in Norway, almost all financial and government institutions allow a form of authentication called BankID ( https://www.bankid.no/en/company/ ). I use the mobile variant and it works for all government related stuff like taxes, health, relocation notices and also with all banks both when logging in and paying bills, signing contracts etc. It is a legally binding identification akin to signing a paper. The procedu…

This is what we use here in Sweden as well. The reason it works is that all inhabitants are given a personal identification number upon birth, that consists of our birthday + 4 digits which are loosely based on where we are born and if we are male/female. This number is unique for every person and is used to register to the BankID service (among other things) and ensures that it is connected to a single individual.

South Korea has exactly that kind of ID and it is causing a major privacy headache in the country because the number itself tells so much about you. https://en.m.wikipedia.org/wiki/Resident_registration_number

Re: The “Cobra Effect” that is disabling paste on password fields

#217

Post by wpietri »

happyslobro wrote: post #128

I have a crazy idea: what if we held people responsible for their own mistakes, instead of turning the world into a padded room? You messed up your password? Reset it. You have a virus / XSS that is slurping the clipboard? It's probably logging keystrokes too, and that's not the devs problem (well, XSS is, but blocking paste isn't the solution)

This is one of those appealing-in-theory philosophies that comes up all the time. But you're ignoring the costs.

For the whole of human civilization, generation n-2 can complain that generation n is turning the world into a padded room. E.g., if you have a car, you expect it to just start at the press of a button or the turn of a key. But starting the Model T required physical strength and an intimate knowledge of the engine:

https://www.youtube.com/watch?v=OfQWnaWLDeQ

People who grew up on the Model T surely bitched about how later cars were making whippersnappers soft, what with their electrical starters and things just working reliably. But nobody today would say, "back to Model Ts so we can toughen up and really learn how internal combustion engines work". We have better things to do. Very smart car designers have made it so that we mostly can just get in and go. Soon, we'll just get in and the car will do the going.

That's what technology is for: We solve problems so other people can do what really matters to them. There is no sense in stopping now and saying, "Fuck it, 5000 years of technological progress is good enough."

Re: The “Cobra Effect” that is disabling paste on password fields

#218

Post by pavel_lishin »

makomk wrote: post #114
mng2 wrote: post #59

Earlier quoted context omitted.

HSBC has this really odd system where they only ask for the (e.g.) 1st, 6th, and 7th characters of your password. That implies that they store plaintext or something reversible...

Yes. This is to protect against attackers obtaining your full plaintext password on your end, for example by phishing or installing keyloggers. In practice this is a much bigger security threat in the online banking world than someone doing the same by compromising the bank's systems - even if that were to happen they can easily re-verify your identity and issue you with a new password, and you really shouldn't be us…

I wonder how often people just type out the full password into the address bar or into notepad, and then start counting to find the nth digit.

Re: The “Cobra Effect” that is disabling paste on password fields

#219

Post by thameera »

bbarn wrote: post #181
matt_morgan wrote: post #153

Is there a way to disable just pieces of JS, so I can turn off "onpaste"? note: sorry, accidentally deleted earlier version of this comment.

I just added it to my list of stuff that pushing this bookmarklet button fixes: javascript:void(document.onmousedown=null);void(document.onclick=null);void(document.oncontextmenu=null);void(document.onpaste=null)

Wouldn't setting `onclick` to null break desired functionality in some sites?

Re: The “Cobra Effect” that is disabling paste on password fields

#220

Post by josteink »

fattire wrote: post #75
ohthehugemanate wrote: post #61

Earlier quoted context omitted.

That doesn't make sense - where did the user copy the email/password from, in order to paste it in twice? Somewhere clear text, ergo easy to double check for typos or at least discover them after the fact. If you're worried about someone copy/pasting a typo, you should disable COPY on the field, not paste.

Yeah disabling copy makes more sense. I think the scenario is where you have to type your password 2x to avoid typos on a field where you can't see what you've just typed (to avoid shoulder surfers).. the first time the user types the password, then they highlight and ^C and then paste into the second field...

> the first time the user types the password, then they highlight and ^C and then paste into the second field...

Except no browser ever allows you to output data (as a clipboard copy-operation is) from a password field.

This is not a real scenario.

Post reply on HN