Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The “Cobra Effect” that is disabling paste on password fields

troyhunt.com

Post reply on HN
Print view View original

341–350 of 450 posts

Re: The “Cobra Effect” that is disabling paste on password fields

#341

Post by benmanns »

eli wrote: post #314
mattkrause wrote: post #296

Earlier quoted context omitted.

I think the idea is that you enter your username and the site replies with the security image that you've chosen. If the image matches, you then enter your password. By itself, this doesn't rule out a man-in-the-middle attack, but it might prevent an attacker from setting up bonkofamerica.com and using it capture valid username/password pairs "offline", which could be reused on the real site. Of course, this depends…

And presumably a halfway skilled attacker could proxy requests to the real site and send the user their actual image. So this only works if we assume the bad guys are lazy and the users are incredibly perceptive.

See 2FA proxying in LostPass https://github.com/cxxr/lostpass

Re: The “Cobra Effect” that is disabling paste on password fields

#342

Post by Natanael_L »

ianferrel wrote: post #339
jameshart wrote: post #322

Earlier quoted context omitted.

It seems astonishing to me to attempt to include in your threat model "login must be secure even on a system which has malware on it". If a system is infected with a keylogger, the LAST thing you want to do is allow the client to log in.

How would you prevent a client from logging in from an infected system?

That's not really the point, it is more of a comment on that there's no point in assisting it.

Re: The “Cobra Effect” that is disabling paste on password fields

#343

Post by mjevans »

The final inanity; what supports a compromised user device from simply submitting it's own copy of the form that it populated, or even transparently proxing the client and MitM on the compromised machine it's self so that it can change the submitted values?

Re: The “Cobra Effect” that is disabling paste on password fields

#344

Post by Retra »

underwater wrote: post #318
takeda wrote: post #285

Earlier quoted context omitted.

Malware can still be capable to take screenshot of the screen. If it would log mouse clicks I would imagine it would at least take screenshot if not a video.

Knowing when to take a screenshot, uploading and storing it, and extracting the password is a lot more work than dumping a text file and grepping for bofa.com.

Psh, only if you're not also logging keys.

Re: The “Cobra Effect” that is disabling paste on password fields

#345

Post by jamez1 »

adventured wrote: post #308
thinkpad20 wrote: post #268

Earlier quoted context omitted.

> consists of our birthday + 4 digits What if you have more than 10,000 people who have the same birthday? Let alone people with similar birthplaces/gender/etc. If that's all there is to it it seems like you'd run up against a combinatorical ceiling pretty soon.

There will never be a problem with that in Sweden. They're averaging 328 births per day. They'd need to increase their population from 10 million to the size of the United States to bump up against that limit. Sweden has added two million people in the last half century. In net terms, essentially all of those two million have been immigrants rather than born in Sweden. They're de-populating when you exclude immigrati…

Assuming people live 70 years on average, isn't this supposed to be 70*328?

Also you have variability, there will be some days that are much more populated than others.

Re: The “Cobra Effect” that is disabling paste on password fields

#346

Post by jamez1 »

brianwawok wrote: post #160
StavrosK wrote: post #93

Earlier quoted context omitted.

You realize that this is trivial to brute force, though.

No. You limit to 3 attempts per user before you go to the bank to show ID. Why do hacker news people think they are better at security than multi billion dollar banks?

I'm guessing you've never worked in IT, but security is a joke in the entire industry.

Everybody knows that we are hopeless at it, and often the flaws that are exploited are just as simple as this.

Re: The “Cobra Effect” that is disabling paste on password fields

#347

Post by oneeyedpigeon »

justsid wrote: post #175
signal11 wrote: post #133

Earlier quoted context omitted.

HSBC doesn't do that any more for me -- they've moved to a Google Authenticator-like 2FA approach[1], but Lloyds[2] does - they have one username and password, and a "memorable phrase" which they clearly store as plaintext because ask for the xth, yth and zth character as a secondary security measure. Lloyds tech folk reading this -- please consider fixing this. [1] http://i.imgur.com/QCGPDWz.png [2] http://i.imgur.c…

I have the memorable phrase and have to use the HSBC app for my password. Now, the fun thing is that my actual HSBC password is 40 characters randomness, so pretty secure. The mobile password that is used to derive the 2FA key must not be longer than 8 characters. So essentially I traded a long and secure password for an 8 character password. I really really dislike HSBCs online banking as a whole, the password syste…

Plus the unintuitive navigation, the ridiculous over-skeuomorphism of 'past statements', and the insanely-low, seemingly non-configurable session timeout. At least you can finally use a payment reference > 10 characters, but HSBC's online banking is still stuck in the stone-age overall.

Re: The “Cobra Effect” that is disabling paste on password fields

#348

Post by NolF »

in_cahoots wrote: post #232
jobigoud wrote: post #230

Earlier quoted context omitted.

And that's exactly the point of OP. You can only "know" weak passwords. Disabling paste is assuming and forcing people to use weak passwords.

What about the people who already have weak passwords, and accidentally misspell their dog's name or whatever? They're probably in the overwhelming majority compared to people using strong, complex passwords. Disabling paste here seems to be more of a convenience decision rather than a security one.

Isn't that what the "I forgot my password" feature is for?

Re: The “Cobra Effect” that is disabling paste on password fields

#349

Post by joshuakcockrell »

eloisius wrote: post #247

TradeKing went full idiot and disabled entering your password by keyboard completely. They implemented an on-screen keyboard and there's no way to opt out. Their support forum is full of angry customers, people who can't use their screen readers anymore, etc. They argue [1] it's to protect their customers from key loggers. [1]: https://community.tradeking.com/forum/categories/suggestions...

Quote from the CEO's blog[1]:

> I agree, it’s a little more inconvenient than before.... but for now we’re asking you to accept a little inconvenience for the sake of greatly enhanced security.

This gives people incentive to pick the shortest possible easiest to input password. Definitely not good for "greatly enhanced security".

[1] http://community.tradeking.com/members/bigdog/blogs/7546-a-w...

Re: The “Cobra Effect” that is disabling paste on password fields

#350

Post by oneeyedpigeon »

banana_giraffe wrote: post #233
simbalion wrote: post #74

It always amazes me that someone is hired to implement strong security and they come up with things like paste-blocking. Or "security questions." Security questions are a social engineers best friend. Unless you're savvy and your answers are all strong passwords themselves, and if they are you're probably using keepass or something like it with 400+ bit passwords and you hate wasting time on security questions too.

I respond with a strong password for all security questions. It created a cute incident recently when I had to verify my account over the phone by telling the phone rep that my favorite pet's name was 'o(c:Y^u=86U@4k', or whatever. I'll give the rep credit, they didn't care the answer made sense, just that it matched their screen.

I'm intrigued as to how you 'pronounced' that. Did you say "open parens" and "caret", and did they understand what you meant? Also, is having to divulge your password really the best way of verifying your account? Do they advise you to change your password immediately after going through this rigmarole?
Post reply on HN