Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The “Cobra Effect” that is disabling paste on password fields

troyhunt.com

Post reply on HN
Print view View original

221–230 of 450 posts

Re: The “Cobra Effect” that is disabling paste on password fields

#221

Post by hartator »

cosecantt wrote: post #205
hartator wrote: post #182

Earlier quoted context omitted.

That wouldnbe still pain text actually, because it's easy to have a table for hash -> char. Chararcters being limited by their numbers.

Fine. Refer to my detailed answer below that shows longer hashing difficult to bruteforce.

I don't find your other answer. But, basically if you hash one character, there is only ~ 255 possibities (a-zA-Z0-9 plus some special chars). So, a 10 characters password is only ~ 2,500 hash to compute and that's nothing. Might as well store it in plaintext, because it in fact is.

Re: The “Cobra Effect” that is disabling paste on password fields

#222

Post by thameera »

happyslobro wrote: post #125
lisivka wrote: post #19

Earlier quoted context omitted.

So, login form can just clear clipboard instead in onsubmit() handler.

Hopefully there is nothing important in the clipbkard, like some data that the user will attempt to submit a second time after logging in. It sounded like a good idea at first, but now I want my +1 back :p

Of course. The implementation should check if the clipboard content is equal to the entered password.

Re: The “Cobra Effect” that is disabling paste on password fields

#223

Post by SloopJon »

mtmail wrote: post #210
Retric wrote: post #204

Earlier quoted context omitted.

SSN's in the US are not unique, though they are only used by one person at a time.

"The Social Security Administration does not reuse Social Security numbers" https://en.wikipedia.org/wiki/Social_Security_number#Exhaust...

Not quite the same thing, but ID Analytics claimed that "6.1 percent of Americans have at least two SSNs associated with their name," and "more than 15 percent of SSNs are associated with two or more people" in commercial records.

Re: The “Cobra Effect” that is disabling paste on password fields

#224

Post by superuser2 »

rsync wrote: post #206
chjohasbrouck wrote: post #83

Earlier quoted context omitted.

It's amazing to me how insecure email is these days. If you know somebody's email, and you have a plausible reason to have a conversation with them, you can very easily take over their email account and reset the password on every account attached to it. I often wonder how much the security of email (and by extension, every other account online) depends on people just not knowing how simple and easy it is to break in…

"If you know somebody's email, and you have a plausible reason to have a conversation with them, you can very easily take over their email account and reset the password on every account attached to it." Not if they self provide their own email (by running their own mailserver).

The same security question nonsense happens at server/VPS providers too.

Re: The “Cobra Effect” that is disabling paste on password fields

#225

Post by mattmaroon »

I always assumed that the reason paste is disabled on change password forms is to prevent you from changing it to something you don't know. The whole point of making you type it twice is so that you get it right. If you type the password once and paste it twice, that is moot.

Not that I necessarily agree with that notion (just make it easy for me to change it again) but that's the idea. I thought.

Re: The “Cobra Effect” that is disabling paste on password fields

#226

Post by gravypod »

tyfon wrote: post #180

Here in Norway, almost all financial and government institutions allow a form of authentication called BankID ( https://www.bankid.no/en/company/ ). I use the mobile variant and it works for all government related stuff like taxes, health, relocation notices and also with all banks both when logging in and paying bills, signing contracts etc. It is a legally binding identification akin to signing a paper. The procedu…

Isn't that vulnerable to MITM attacks for GSM? There have been quite a few demonstrated at DEFCON that could work very well for attacking this kind of system (on a large scale)

Re: The “Cobra Effect” that is disabling paste on password fields

#227

Post by zippergz »

markcerqueira wrote: post #4

Fortunately, it's not hard to get around this on desktop (for Mac at least) with an applet like Paste Typer. But when I see this on iOS it infuriates me. I use 1Password to generate strong (long) passwords and having to type them out manually is a huge PIA.

The annoying one on iOS is how often it makes me re-enter my Apple ID password. In a modal, of course, so it's impossible to bounce out to 1Password to copy the (very long and complex) password without dismissing the modal first. Sometimes I'll get a "re-enter your apple id password" modal at some random time while I'm doing something else, dismiss it to go get the password, and then have no idea how to get it back because I don't know what triggered it in the first place...

Re: The “Cobra Effect” that is disabling paste on password fields

#228

Post by ryanlol »

chris_wot wrote: post #137
makomk wrote: post #114

Earlier quoted context omitted.

Yes. This is to protect against attackers obtaining your full plaintext password on your end, for example by phishing or installing keyloggers. In practice this is a much bigger security threat in the online banking world than someone doing the same by compromising the bank's systems - even if that were to happen they can easily re-verify your identity and issue you with a new password, and you really shouldn't be us…

How does this prevent key logging attacks? You still type in those characters. And secondly, that just immediately made it a hell of a lot easier to brute force your way through the passwords!

And they totally wont kill the account after a couple of wrong attempts, right?

Re: The “Cobra Effect” that is disabling paste on password fields

#229

Post by coldtea »

dogma1138 wrote: post #192
coldtea wrote: post #168

Earlier quoted context omitted.

So they attacker just has to run the keylogger for enough time...

The attacker needs to both be able to read the page and key log every keystroke and be able to associate as single letter, digit, or symbol to you password and not only that to the correct placement within the password. This is virtually impossible to achieve by any effective means. They ask random characters from your password in a random order if you login into your bank twice a week it most likely will a year or m…

>This is virtually impossible to achieve by any effective means.

Actually it's very simple to achieve.

First, those digits will not be randomly placed among all the things you've typed, but they'd follow some specific patterns (the most obvious one being you typing all of part --due to autocomplete-- of the bank's url).

(Of course if you can run a keylogger you can also check what website is loaded on the browser and log that information alongside the keys too, but you don't even need to go that far).

So, we established that the attacker checking the keylogger logs can trivially tell - "now they're typing their banking password".

If they also knew the correct placement that would be handy, but they can do without it too. Just knowing those N characters are from your password (in any order) really improves the possibilities they need to search.

Even if it takes a year, either they are very dedicated to you as a special (large bank account) profile target, so they can wait, or they are logging tens of thousands, via some malware, so it's still worth it to wait.

Re: The “Cobra Effect” that is disabling paste on password fields

#230

Post by jobigoud »

mattmaroon wrote: post #225

I always assumed that the reason paste is disabled on change password forms is to prevent you from changing it to something you don't know. The whole point of making you type it twice is so that you get it right. If you type the password once and paste it twice, that is moot. Not that I necessarily agree with that notion (just make it easy for me to change it again) but that's the idea. I thought.

And that's exactly the point of OP. You can only "know" weak passwords. Disabling paste is assuming and forcing people to use weak passwords.
Post reply on HN