The “Cobra Effect” that is disabling paste on password fields • Hacker News Board

Re: The “Cobra Effect” that is disabling paste on password fields

#291

Post by boulos » Sun, Jun 26, 2016, 6:30 PM UTC

TeMPOraL wrote: post #286

takeda wrote: post #281

Earlier quoted context omitted.

I never used them, but my guess they try to make one time passwords from your passwords. They probably ask to enter e.g. 3rd, 6th and 8th letter of the password. Supposedly if someone logs it it supposedly won't be as useful, because next time it will ask for different letters. Not sure why won't they use rsa keys or similar technology. Also if it is the way I think it is, then you know that your passwords aren't has…

> Also if it is the way I think it is, then you know that your passwords aren't hashed on their servers. Only if the developers are extremely lazy. A proper implementation would precompute a series of hashes for different subsets of the password and store them in the database instead. Similar to how Facebook stores both the password and its reversed-case form as a convenience feature for people who forget to turn the…

But how many subsets would you do? With enough of them (and particularly relative to password length) this would leak a lot about your password. For say an 8 character password, do these things ask you to enter more than 4 characters?

Re: The “Cobra Effect” that is disabling paste on password fields

#292

Post by TeMPOraL » Sun, Jun 26, 2016, 6:33 PM UTC

coredog64 wrote: post #241

wbkang wrote: post #216

Earlier quoted context omitted.

South Korea has exactly that kind of ID and it is causing a major privacy headache in the country because the number itself tells so much about you. https://en.m.wikipedia.org/wiki/Resident_registration_number

US SSNs used to be that way. The initial prefix was based on where you applied, and the last four were shown like it was nothing (Boeing used my last 4 as part of my UNIX account ID). Instead of 5-9 digits of entropy, you're down to just 2.

I still don't get why anyone would ever want to treat SSN / national ID numbers as private information. They're usernames, you give them to so many people all the time and they're printed in so many places plain that it's ridiculous to think they should be used as a secret for authentication.

Re: The “Cobra Effect” that is disabling paste on password fields

#293

Post by ams6110 » Sun, Jun 26, 2016, 6:33 PM UTC

SilasX wrote: post #259

mtmail wrote: post #210

Earlier quoted context omitted.

"The Social Security Administration does not reuse Social Security numbers" https://en.wikipedia.org/wiki/Social_Security_number#Exhaust...

Well good luck when the keyspace is one billion, and the current population is about a third of that.

The keyspace is also shared with the larger "TIN" (Tax ID Number) pool, though the pretty-print format is different:

SSN and ITIN: nnn-nn-nnnn EIN: nn-nnnnnnn

So it covers not only all the individual taxpayers but also all the employers and businesses that are taxable separately from individual income tax payers.

Re: The “Cobra Effect” that is disabling paste on password fields

#294

Post by ams6110 » Sun, Jun 26, 2016, 6:40 PM UTC

banana_giraffe wrote: post #233

simbalion wrote: post #74

It always amazes me that someone is hired to implement strong security and they come up with things like paste-blocking. Or "security questions." Security questions are a social engineers best friend. Unless you're savvy and your answers are all strong passwords themselves, and if they are you're probably using keepass or something like it with 400+ bit passwords and you hate wasting time on security questions too.

I respond with a strong password for all security questions. It created a cute incident recently when I had to verify my account over the phone by telling the phone rep that my favorite pet's name was 'o(c:Y^u=86U@4k', or whatever. I'll give the rep credit, they didn't care the answer made sense, just that it matched their screen.

I do that too but shot myself in the foot on one site. Somehow I did not get one of the three random "answers" recorded in my password manager. And of course THAT is the question the site is now insisting I answer. I have tried a few times hoping one of the other two questions is presented, but so far no luck.

Re: The “Cobra Effect” that is disabling paste on password fields

#295

Post by TeMPOraL » Sun, Jun 26, 2016, 6:42 PM UTC

boulos wrote: post #291

TeMPOraL wrote: post #286

Earlier quoted context omitted.

> Also if it is the way I think it is, then you know that your passwords aren't hashed on their servers. Only if the developers are extremely lazy. A proper implementation would precompute a series of hashes for different subsets of the password and store them in the database instead. Similar to how Facebook stores both the password and its reversed-case form as a convenience feature for people who forget to turn the…

But how many subsets would you do? With enough of them (and particularly relative to password length) this would leak a lot about your password. For say an 8 character password, do these things ask you to enter more than 4 characters?

On my >10 character passwords (I generally don't use shorter passwords with banking sites, so I don't know how the system behaves for short passwords) they ask for ~11 characters. Of course the login box can, and often ends up, being longer than your actual password, so it doesn't visually reveal the actual character count of your password. In my case they usually end up asking for ~5-7 "real" characters.

I presume a good implementation hashes and salts each "sub-password" separately. Since it's the server that decides which subset it wants, I don't think it reduces the search space, unless the hashing/salting algorithm is vulnerable to differential cryptanalysis (which it may be, I don't know this aspect of state-of-the-art hashing functions).

Re: The “Cobra Effect” that is disabling paste on password fields

#296

Post by mattkrause » Sun, Jun 26, 2016, 6:44 PM UTC

TeMPOraL wrote: post #288

eli wrote: post #275

Earlier quoted context omitted.

They also have the silly "Security Image" which is supposed to alert me to a phishing site because I'm supposed to notice its absence. I'm guessing that's been effective roughly never.

Any idea how it works and what makes it (supposedly) impossible for a phishing site to copy?

I think the idea is that you enter your username and the site replies with the security image that you've chosen. If the image matches, you then enter your password.

By itself, this doesn't rule out a man-in-the-middle attack, but it might prevent an attacker from setting up bonkofamerica.com and using it capture valid username/password pairs "offline", which could be reused on the real site. Of course, this depends on people noticing (and caring) that the image is missing or incorrect, so who knows...

Re: The “Cobra Effect” that is disabling paste on password fields

#297

Post by ghayes » Sun, Jun 26, 2016, 6:45 PM UTC

ams6110 wrote: post #287

takeda wrote: post #281

Earlier quoted context omitted.

I never used them, but my guess they try to make one time passwords from your passwords. They probably ask to enter e.g. 3rd, 6th and 8th letter of the password. Supposedly if someone logs it it supposedly won't be as useful, because next time it will ask for different letters. Not sure why won't they use rsa keys or similar technology. Also if it is the way I think it is, then you know that your passwords aren't has…

then you know that your passwords aren't hashed on their servers This is the immediate alarm that went off in my head reading about this. I've never seen this before either and it sounds like an idea from someone who means well but doesn't understand what they are doing.

They could hash each combination. Probably reduces security, but not a dead giveaway.

Re: The “Cobra Effect” that is disabling paste on password fields

#298

Post by SilasX » Sun, Jun 26, 2016, 6:46 PM UTC

ams6110 wrote: post #293

SilasX wrote: post #259

Earlier quoted context omitted.

Well good luck when the keyspace is one billion, and the current population is about a third of that.

The keyspace is also shared with the larger "TIN" (Tax ID Number) pool, though the pretty-print format is different: SSN and ITIN: nnn-nn-nnnn EIN: nn-nnnnnnn So it covers not only all the individual taxpayers but also all the employers and businesses that are taxable separately from individual income tax payers.

So ... how can it not be exhausted yet, or at least close enough that it's irresponsible for officials to offer blanket denials regarding reuse of defuncts?

Re: The “Cobra Effect” that is disabling paste on password fields

#299

Post by ams6110 » Sun, Jun 26, 2016, 6:46 PM UTC

level3 wrote: post #18

morgante wrote: post #12

Earlier quoted context omitted.

That's still not a very good reason. If you're security conscious, you shouldn't be typing passwords at all. You should generate them from a password manager and paste them into the field both times. It boils down to security theater making us all less secure.

As someone running a user-facing site, you cannot control whether your users use password managers. So what's your solution? Just disregard the segment of your users who don't use password managers? That's a tradeoff that you might not want to make, depending on your business. Also, if you're someone who uses a password manager, does disabling pasting really make you less secure? I assume you're still generating pass…

I think I am slightly dyslexic, and have immense difficulty correcly transcribing a random string that is more than about 8 characters especially if it has numbers and random non-alpha characters. Logins that don't allow pasting the password often cause me to lock myself out due to repeated errors typing the password.

Re: The “Cobra Effect” that is disabling paste on password fields

#300

Post by jegoodwin3 » Sun, Jun 26, 2016, 7:02 PM UTC

Perhaps the companies involved have been told by their lawyers that choosing a password is a legal action, like an electronic signature, that must be performed by a human, letter by letter, to have certain legal ramifications.

It is only stupidity if you assume the only purpose of a password (or a physical key) is security, and not also authorized entry. It may still be a poor engineering solution to the requirement (because engineers were told the solution, to asked to meet the requirement). But it is wrong to assume there is no reason for the requirement.

You can't paste your legally binding electronic signature either, I'll warrant. I've had to type out my name plenty of times, in digital contracts, even though my browser is quite capable of auto-filling.