Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The “Cobra Effect” that is disabling paste on password fields

troyhunt.com

Post reply on HN
Print view View original

281–290 of 450 posts

Re: The “Cobra Effect” that is disabling paste on password fields

#281

Post by takeda »

ghurtado wrote: post #277
gvurrdon wrote: post #276

Earlier quoted context omitted.

Another one that is a great pain are the sites that insist upon asking for three letters from one's password to log in. This is all very well if one has an insecure password, but when I've created a 20-character password containing all the necessary characters then this makes it rather more difficult to enter the required values.

> three letters from one's password to log in Could you explain how this works? I've never ran into this and I'm curious as to what it solves / they claim it solves.

I never used them, but my guess they try to make one time passwords from your passwords.

They probably ask to enter e.g. 3rd, 6th and 8th letter of the password. Supposedly if someone logs it it supposedly won't be as useful, because next time it will ask for different letters.

Not sure why won't they use rsa keys or similar technology. Also if it is the way I think it is, then you know that your passwords aren't hashed on their servers.

Re: The “Cobra Effect” that is disabling paste on password fields

#282

Post by [deleted] »

anowlcalledjosh wrote: post #238
hobs wrote: post #178

Earlier quoted context omitted.

Why cant they just also hash those three letter combinations they ask you? Not nearly as secure but I see many people saying that the plaintext must be stored to achieve this, and all I am thinking is that it would require you to store multiple hashes for each user, each a portion of their password. Still a lot easier to guess a portion of a password than a password, but it doesnt follow in my mind that it is definit…

It would be absolutely trivial to enumerate all possible three-letter combinations and hash them. That's no better than storing in plaintext.

[deleted]

Re: The “Cobra Effect” that is disabling paste on password fields

#283

Post by monochromatic »

eloisius wrote: post #247

TradeKing went full idiot and disabled entering your password by keyboard completely. They implemented an on-screen keyboard and there's no way to opt out. Their support forum is full of angry customers, people who can't use their screen readers anymore, etc. They argue [1] it's to protect their customers from key loggers. [1]: https://community.tradeking.com/forum/categories/suggestions...

http://www.treasurydirect.gov as well.

Re: The “Cobra Effect” that is disabling paste on password fields

#284

Post by TeMPOraL »

ghurtado wrote: post #277
gvurrdon wrote: post #276

Earlier quoted context omitted.

Another one that is a great pain are the sites that insist upon asking for three letters from one's password to log in. This is all very well if one has an insecure password, but when I've created a 20-character password containing all the necessary characters then this makes it rather more difficult to enter the required values.

> three letters from one's password to log in Could you explain how this works? I've never ran into this and I'm curious as to what it solves / they claim it solves.

I think GP is referring to the practice of asking you to type some amount of random characters from your password. It seems to be popular with banks nowadays. The field looks like this:

    [ ][X][X][ ][X][X][ ][X][ ][X][X][ ][ ][X][ ]
(you enter characters in the blanks)

The idea is supposedly to protect people from keyloggers. But the side effect is that more sophisticated passwords get excruciatingly annoying to type in.

Re: The “Cobra Effect” that is disabling paste on password fields

#285

Post by takeda »

jsudhams wrote: post #267
blazespin wrote: post #256

Earlier quoted context omitted.

Cause key loggers don't track mouse clicks. Lol. Two factor is their best bet.

VIrtual keyboard changes the character location every time it shows so unless u record click for log time or screen record it is difficult

Malware can still be capable to take screenshot of the screen. If it would log mouse clicks I would imagine it would at least take screenshot if not a video.

Re: The “Cobra Effect” that is disabling paste on password fields

#286

Post by TeMPOraL »

takeda wrote: post #281
ghurtado wrote: post #277

Earlier quoted context omitted.

> three letters from one's password to log in Could you explain how this works? I've never ran into this and I'm curious as to what it solves / they claim it solves.

I never used them, but my guess they try to make one time passwords from your passwords. They probably ask to enter e.g. 3rd, 6th and 8th letter of the password. Supposedly if someone logs it it supposedly won't be as useful, because next time it will ask for different letters. Not sure why won't they use rsa keys or similar technology. Also if it is the way I think it is, then you know that your passwords aren't has…

> Also if it is the way I think it is, then you know that your passwords aren't hashed on their servers.

Only if the developers are extremely lazy. A proper implementation would precompute a series of hashes for different subsets of the password and store them in the database instead. Similar to how Facebook stores both the password and its reversed-case form as a convenience feature for people who forget to turn their CAPS LOCK off.

Re: The “Cobra Effect” that is disabling paste on password fields

#287

Post by ams6110 »

takeda wrote: post #281
ghurtado wrote: post #277

Earlier quoted context omitted.

> three letters from one's password to log in Could you explain how this works? I've never ran into this and I'm curious as to what it solves / they claim it solves.

I never used them, but my guess they try to make one time passwords from your passwords. They probably ask to enter e.g. 3rd, 6th and 8th letter of the password. Supposedly if someone logs it it supposedly won't be as useful, because next time it will ask for different letters. Not sure why won't they use rsa keys or similar technology. Also if it is the way I think it is, then you know that your passwords aren't has…

then you know that your passwords aren't hashed on their servers

This is the immediate alarm that went off in my head reading about this. I've never seen this before either and it sounds like an idea from someone who means well but doesn't understand what they are doing.

Re: The “Cobra Effect” that is disabling paste on password fields

#288

Post by TeMPOraL »

eli wrote: post #275
natermer wrote: post #272

Earlier quoted context omitted.

Which why you run screaming away from these sorts of organizations. If they are too fucking stupid to implement a password text field correctly just imagine the byzantine nightmares that their infrastructure is. All you are doing is volunteering to be part of the next major security breach.

They also have the silly "Security Image" which is supposed to alert me to a phishing site because I'm supposed to notice its absence. I'm guessing that's been effective roughly never.

Any idea how it works and what makes it (supposedly) impossible for a phishing site to copy?

Re: The “Cobra Effect” that is disabling paste on password fields

#289

Post by tamana »

twic wrote: post #101
mng2 wrote: post #59

Earlier quoted context omitted.

HSBC has this really odd system where they only ask for the (e.g.) 1st, 6th, and 7th characters of your password. That implies that they store plaintext or something reversible...

The Co-operative Bank does this too. They absolutely store the password in plain text, because if you phone up, you have to tell the whole thing to the phone operator. To be fair, they're right in the middle of rolling out a new banking site which I think has proper passwords. The current system is a holdover from when they only had phone banking.

That does not mean they store plaintext passwords. When you login to most any website you have to submit your whole password. It is usually hashed and the hash is compare to the stored hashed pasword

Re: The “Cobra Effect” that is disabling paste on password fields

#290

Post by TeMPOraL »

jsudhams wrote: post #267
blazespin wrote: post #256

Earlier quoted context omitted.

Cause key loggers don't track mouse clicks. Lol. Two factor is their best bet.

VIrtual keyboard changes the character location every time it shows so unless u record click for log time or screen record it is difficult

Does it randomize its DOM elements too?
Post reply on HN