Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The “Cobra Effect” that is disabling paste on password fields

troyhunt.com

Post reply on HN
Print view View original

331–340 of 450 posts

Re: The “Cobra Effect” that is disabling paste on password fields

#331

Post by superuser2 »

zippergz wrote: post #227
markcerqueira wrote: post #4

Fortunately, it's not hard to get around this on desktop (for Mac at least) with an applet like Paste Typer. But when I see this on iOS it infuriates me. I use 1Password to generate strong (long) passwords and having to type them out manually is a huge PIA.

The annoying one on iOS is how often it makes me re-enter my Apple ID password. In a modal, of course, so it's impossible to bounce out to 1Password to copy the (very long and complex) password without dismissing the modal first. Sometimes I'll get a "re-enter your apple id password" modal at some random time while I'm doing something else, dismiss it to go get the password, and then have no idea how to get it back b…

> re-enter my Apple ID password

I find it absolutely infuriating that this is necessary even when "purchasing" a free app.

The #1 reason I will not buy an app is because I do not want to deal with entering my Apple ID password yet another goddamn time.

If your phone shuts all the way down with any regularity, it's a nightmare.

Re: The “Cobra Effect” that is disabling paste on password fields

#332

Post by malbs »

c3534l wrote: post #320
simbalion wrote: post #74

It always amazes me that someone is hired to implement strong security and they come up with things like paste-blocking. Or "security questions." Security questions are a social engineers best friend. Unless you're savvy and your answers are all strong passwords themselves, and if they are you're probably using keepass or something like it with 400+ bit passwords and you hate wasting time on security questions too.

My school had me sign up for a service that required an 8-character long password containing at least one number, one special character, and a mix of uppercase and lowercase letters. The recovery question was "what is your father's middle name?" No way anyone could find that out or guess an incredibly common middle name. Also I should mention that our school required us to sign up using our school email address as ou…

You're assuming they used a consultant. I doubt it.

Re: The “Cobra Effect” that is disabling paste on password fields

#333

Post by GigabyteCoin »

MRSallee wrote: post #317

I doubt that the motivation for preventing paste in a "confirm password" context is to prevent workarounds to character limits. Why does the "confirm password" field exist anyway? It exists to remove the risk of input error. They want to avoid you locking into a mistyped password and not being able to recover. To this end, it makes some sense to prevent copy/paste, as a user may simply copy their mistyped password an…

>Why does the "confirm password" field exist anyway? It exists to remove the risk of input error. They want to avoid you locking into a mistyped password and not being able to recover.

It seems silly to force everybody to doubly enter their password, when I'd guess at most ~10% of people might enter an incorrect password on their first try at which point those unfortunate ones are only a few minutes away from a password reset... where they would be sure to get the password right that second time.

Re: The “Cobra Effect” that is disabling paste on password fields

#334

Post by davidwhodge »

derekdahmer wrote: post #328
MRSallee wrote: post #317

I doubt that the motivation for preventing paste in a "confirm password" context is to prevent workarounds to character limits. Why does the "confirm password" field exist anyway? It exists to remove the risk of input error. They want to avoid you locking into a mistyped password and not being able to recover. To this end, it makes some sense to prevent copy/paste, as a user may simply copy their mistyped password an…

I don't think thats right because browsers have always prevented password fields from being copied.

Requiring input twice as input validation has a fair amount of use already, like with email addresses, so it doesn't seem super unreasonable to think that's a motivation for this limitation.

Also, while it sounds silly, disabling copy doesn't mean a user can't type the PW somewhere else and paste it in. I've totally done that before and suspect it's not super uncommon.

Re: The “Cobra Effect” that is disabling paste on password fields

#335

Post by gravypod »

wool_gather wrote: post #330
gravypod wrote: post #226

Earlier quoted context omitted.

Isn't that vulnerable to MITM attacks for GSM? There have been quite a few demonstrated at DEFCON that could work very well for attacking this kind of system (on a large scale)

Yes, and not only MITM, but IRL impersonation attacks; Wired published an article about it today: https://www.wired.com/2016/06/hey-stop-using-texts-two-facto... Attackers convinced (either with their official badges or by conning) the targets' cell service providers to change the SIM info associated with the accounts, and thereby intercepted SMS authentication codes.

Yea, using a closed source and poorly vetted protocol for secure operations doesn't really sound like a good idea to me.

I hope this gets fixed.

Re: The “Cobra Effect” that is disabling paste on password fields

#336

Post by gravypod »

bebop wrote: post #255
gravypod wrote: post #226

Earlier quoted context omitted.

Isn't that vulnerable to MITM attacks for GSM? There have been quite a few demonstrated at DEFCON that could work very well for attacking this kind of system (on a large scale)

Would the short phrase from the website over TSL mitigate this? Even if someone could snoop the GSM, there would still be some (hopefully random) string that only the web server and client would know.

The main in the middle could just decode any secret being sent. The only way I'd want to participate in a system like this is via a smartcard or a challenge based system over TLS

Re: The “Cobra Effect” that is disabling paste on password fields

#337

Post by admax88q »

tajen wrote: post #315
ryan-c wrote: post #305

Earlier quoted context omitted.

It would effectively be a dead giveaway. Exhaustively searching all combinations of three characters takes trivial time even in an excruciatingly slow hash.

but it prevents MitM spying.

Hashing passwords is not done to prevent MitM, it's done to prevent/delay password disclosure if the database is hacked.

Re: The “Cobra Effect” that is disabling paste on password fields

#338

Post by megalodon »

megalodon wrote: post #185
tyfon wrote: post #180

Here in Norway, almost all financial and government institutions allow a form of authentication called BankID ( https://www.bankid.no/en/company/ ). I use the mobile variant and it works for all government related stuff like taxes, health, relocation notices and also with all banks both when logging in and paying bills, signing contracts etc. It is a legally binding identification akin to signing a paper. The procedu…

This is what we use here in Sweden as well. The reason it works is that all inhabitants are given a personal identification number upon birth, that consists of our birthday + 4 digits which are loosely based on where we are born and if we are male/female. This number is unique for every person and is used to register to the BankID service (among other things) and ensures that it is connected to a single individual.

Okay, wow. Just clicked the https://www.bankid.no/en/ link and it looks like it's two entirely different companies using the same name?

In Sweden we use https://www.bankid.com/en/ which doesn't use SMS for authentication, it's mobile app based.

Re: The “Cobra Effect” that is disabling paste on password fields

#339

Post by ianferrel »

jameshart wrote: post #322
eloisius wrote: post #247

TradeKing went full idiot and disabled entering your password by keyboard completely. They implemented an on-screen keyboard and there's no way to opt out. Their support forum is full of angry customers, people who can't use their screen readers anymore, etc. They argue [1] it's to protect their customers from key loggers. [1]: https://community.tradeking.com/forum/categories/suggestions...

It seems astonishing to me to attempt to include in your threat model "login must be secure even on a system which has malware on it". If a system is infected with a keylogger, the LAST thing you want to do is allow the client to log in.

How would you prevent a client from logging in from an infected system?

Re: The “Cobra Effect” that is disabling paste on password fields

#340

Post by DavidSJ »

MRSallee wrote: post #317

I doubt that the motivation for preventing paste in a "confirm password" context is to prevent workarounds to character limits. Why does the "confirm password" field exist anyway? It exists to remove the risk of input error. They want to avoid you locking into a mistyped password and not being able to recover. To this end, it makes some sense to prevent copy/paste, as a user may simply copy their mistyped password an…

I often use copy/paste to prevent typing errors. I save the password in some keychain software, then I copy/paste the password from that software into one of the password fields, and type it myself into the other.
Post reply on HN