Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The “Cobra Effect” that is disabling paste on password fields

troyhunt.com

Post reply on HN
Print view View original

311–320 of 450 posts

Re: The “Cobra Effect” that is disabling paste on password fields

#311

Post by morgante »

simbalion wrote: post #74

It always amazes me that someone is hired to implement strong security and they come up with things like paste-blocking. Or "security questions." Security questions are a social engineers best friend. Unless you're savvy and your answers are all strong passwords themselves, and if they are you're probably using keepass or something like it with 400+ bit passwords and you hate wasting time on security questions too.

> Unless you're savvy and your answers are all strong passwords themselves, and if they are you're probably using keepass or something like it with 400+ bit passwords and you hate wasting time on security questions too.

The worst part is that some companies (TradeKing) turn these into multiple choice questions, where a password-like answer will stand out like a sore thumb.

Re: The “Cobra Effect” that is disabling paste on password fields

#312

Post by fnordsensei »

wbkang wrote: post #216
megalodon wrote: post #185

Earlier quoted context omitted.

This is what we use here in Sweden as well. The reason it works is that all inhabitants are given a personal identification number upon birth, that consists of our birthday + 4 digits which are loosely based on where we are born and if we are male/female. This number is unique for every person and is used to register to the BankID service (among other things) and ensures that it is connected to a single individual.

South Korea has exactly that kind of ID and it is causing a major privacy headache in the country because the number itself tells so much about you. https://en.m.wikipedia.org/wiki/Resident_registration_number

In Sweden, we were at some point running out of numbers as when there were an unprecedented number of applicants due to the immigration a while back.

Someone was interviewed on the subject and said that if they built the system today, they would totally go for randomly generated number sequences rather than relying on a system based on birth date etc.

Re: The “Cobra Effect” that is disabling paste on password fields

#313

Post by kowdermeister »

jegoodwin3 wrote: post #300

Perhaps the companies involved have been told by their lawyers that choosing a password is a legal action, like an electronic signature, that must be performed by a human, letter by letter, to have certain legal ramifications. It is only stupidity if you assume the only purpose of a password (or a physical key) is security, and not also authorized entry. It may still be a poor engineering solution to the requirement…

> It is only stupidity if you assume the only purpose of a password (or a physical key) is security, and not also authorized entry.

What's the difference really? I'm either way blocked from accessing my account. I don't give a damn what that some idiot nontechnical lawyer put into the ToS. I find these kind of services annoying anyways and the first sign is usually forcing me to pick a less secure password.

Re: The “Cobra Effect” that is disabling paste on password fields

#314

Post by eli »

mattkrause wrote: post #296
TeMPOraL wrote: post #288

Earlier quoted context omitted.

Any idea how it works and what makes it (supposedly) impossible for a phishing site to copy?

I think the idea is that you enter your username and the site replies with the security image that you've chosen. If the image matches, you then enter your password. By itself, this doesn't rule out a man-in-the-middle attack, but it might prevent an attacker from setting up bonkofamerica.com and using it capture valid username/password pairs "offline", which could be reused on the real site. Of course, this depends…

And presumably a halfway skilled attacker could proxy requests to the real site and send the user their actual image. So this only works if we assume the bad guys are lazy and the users are incredibly perceptive.

Re: The “Cobra Effect” that is disabling paste on password fields

#315

Post by tajen »

ryan-c wrote: post #305
ghayes wrote: post #297

Earlier quoted context omitted.

They could hash each combination. Probably reduces security, but not a dead giveaway.

It would effectively be a dead giveaway. Exhaustively searching all combinations of three characters takes trivial time even in an excruciatingly slow hash.

but it prevents MitM spying.

Re: The “Cobra Effect” that is disabling paste on password fields

#316

Post by azinman2 »

jsudhams wrote: post #267
blazespin wrote: post #256

Earlier quoted context omitted.

Cause key loggers don't track mouse clicks. Lol. Two factor is their best bet.

VIrtual keyboard changes the character location every time it shows so unless u record click for log time or screen record it is difficult

Wow that's a terrible UX -- randomized keyboard every time? Talk about an incentive to NOT login!

Re: The “Cobra Effect” that is disabling paste on password fields

#317

Post by MRSallee »

I doubt that the motivation for preventing paste in a "confirm password" context is to prevent workarounds to character limits.

Why does the "confirm password" field exist anyway? It exists to remove the risk of input error. They want to avoid you locking into a mistyped password and not being able to recover. To this end, it makes some sense to prevent copy/paste, as a user may simply copy their mistyped password and paste it into the confirmation field. Especially risky if the input fields are obfuscated with placeholder characters (*).

Not to argue that it's the right answer, it certainly makes more sense than a heavy-handed enforcement of character limits.

Re: The “Cobra Effect” that is disabling paste on password fields

#318

Post by underwater »

takeda wrote: post #285
jsudhams wrote: post #267

Earlier quoted context omitted.

VIrtual keyboard changes the character location every time it shows so unless u record click for log time or screen record it is difficult

Malware can still be capable to take screenshot of the screen. If it would log mouse clicks I would imagine it would at least take screenshot if not a video.

Knowing when to take a screenshot, uploading and storing it, and extracting the password is a lot more work than dumping a text file and grepping for bofa.com.

Re: The “Cobra Effect” that is disabling paste on password fields

#319

Post by prab97 »

megalodon wrote: post #185
tyfon wrote: post #180

Here in Norway, almost all financial and government institutions allow a form of authentication called BankID ( https://www.bankid.no/en/company/ ). I use the mobile variant and it works for all government related stuff like taxes, health, relocation notices and also with all banks both when logging in and paying bills, signing contracts etc. It is a legally binding identification akin to signing a paper. The procedu…

This is what we use here in Sweden as well. The reason it works is that all inhabitants are given a personal identification number upon birth, that consists of our birthday + 4 digits which are loosely based on where we are born and if we are male/female. This number is unique for every person and is used to register to the BankID service (among other things) and ensures that it is connected to a single individual.

Does that mean, not more than 9999 people can take birth in Sweden in a day?

Re: The “Cobra Effect” that is disabling paste on password fields

#320

Post by c3534l »

simbalion wrote: post #74

It always amazes me that someone is hired to implement strong security and they come up with things like paste-blocking. Or "security questions." Security questions are a social engineers best friend. Unless you're savvy and your answers are all strong passwords themselves, and if they are you're probably using keepass or something like it with 400+ bit passwords and you hate wasting time on security questions too.

My school had me sign up for a service that required an 8-character long password containing at least one number, one special character, and a mix of uppercase and lowercase letters. The recovery question was "what is your father's middle name?" No way anyone could find that out or guess an incredibly common middle name. Also I should mention that our school required us to sign up using our school email address as our username, which was assigned to us on the basis of the first letter of our first name and our entire surname. And also the address says where we go to school.

Do security consultants just completely lack common sense?

Post reply on HN