Backblaze is another company that does this, which is infuriating when you're entering your long private key into their client. CTRL-V doesn't work, but surprisingly, right-clicking and selecting paste does. I didn't realize this until I the second time I had to enter the key.
The “Cobra Effect” that is disabling paste on password fields
351–360 of 450 posts
Re: The “Cobra Effect” that is disabling paste on password fields
#352Earlier quoted context omitted.
Oh good so I'm not alone! I tried setting it up but trying to mass import multiple passwords from KeePass over (which doesn't translate directly 1 to 1) left me manually entering them. The process was so incredibly slow and cumbersome that I gave up. It doesn't help that LastPass looks like it was created in 2003 by developers with zero UX / design talent. I hope they can improve that one day.
When did you try it? It very recently went through a total ux overhaul. Big improvement imo.
It's gone from apocalyptically bad to horrendously bad.
I have no idea where they thought any of that UX would be even remotely a good idea. Everything about it is misguided to such an extreme I'm left wondering if there's a single human on their development team.
1password may not be perfect, but their attention to usability is obvious!
Re: The “Cobra Effect” that is disabling paste on password fields
#353Earlier quoted context omitted.
I respond with a strong password for all security questions. It created a cute incident recently when I had to verify my account over the phone by telling the phone rep that my favorite pet's name was 'o(c:Y^u=86U@4k', or whatever. I'll give the rep credit, they didn't care the answer made sense, just that it matched their screen.
I'm intrigued as to how you 'pronounced' that. Did you say "open parens" and "caret", and did they understand what you meant? Also, is having to divulge your password really the best way of verifying your account? Do they advise you to change your password immediately after going through this rigmarole?
I would have rattled off something like "oh open paren sea cap why colon caret you equals" and so on. Honestly I have no idea if they parsed the sentence, or decided "gibberish from phone equals gibberish on screen .. good enough"
They didn't advise me to change my security question, no doubt because the name of my favorite childhood pet isn't likely to change.
Re: The “Cobra Effect” that is disabling paste on password fields
#354Earlier quoted context omitted.
Any idea how it works and what makes it (supposedly) impossible for a phishing site to copy?
I think the idea is that you enter your username and the site replies with the security image that you've chosen. If the image matches, you then enter your password. By itself, this doesn't rule out a man-in-the-middle attack, but it might prevent an attacker from setting up bonkofamerica.com and using it capture valid username/password pairs "offline", which could be reused on the real site. Of course, this depends…
> it might prevent an attacker from setting up bonkofamerica.com and using it capture valid username/password pairs "offline", which could be reused on the real site.
Exactly so. That was a pretty frequent vector when those images became popular, so it wasn't a crazy defensive move. Even though there are ways for criminals to defeat it, proper mitm for one, those were more complicated measures that weren't as commonly used. Higher risks, development costs, trouble with scaling, or just unnecessary, for whatever reason, the static dumb credential harvesting pages that look "legit enough" were most common.
A company with limited defensive resources could approach security like a greedy algorithm. Just constantly ask, "How are most customers at institutions similar to my own getting compromised right now? How do I prevent that with as much blunt force as possible that I can deploy as soon as possible?"
That would probably get you some bizarre defensive solutions that reduce usability. But it's not an obviously crazy general strategy.
Well, major caveat: presuming you're at least doing the basics right. If you aren't bothering with hashes, then your men are already dead.
Re: The “Cobra Effect” that is disabling paste on password fields
#355Earlier quoted context omitted.
He never described the _initiative_ as imperialist, just the British rulers. Since the British rule of colonial India is virtually the dictionary definition of imperialism, I'll go ahead and call the author's word choice reasonable.
While you're in the dictionary you might look up the word portray.
It's true that the article doesn't describe the initiative as imperialist in so many words, but it does portray it as such in the sense of putting "imperial or sovereign interests over the interests of the dependent states" [1]. I apologise, my use of the word "imperialist" was quite redundant as I had already used "self-interested". I further apologise for extending this tedious game of definitions but since I have now been flagged as well as downvoted, I can only assume that my original comment was desperately unclear.
Re: The “Cobra Effect” that is disabling paste on password fields
#356Earlier quoted context omitted.
Yes. This is to protect against attackers obtaining your full plaintext password on your end, for example by phishing or installing keyloggers. In practice this is a much bigger security threat in the online banking world than someone doing the same by compromising the bank's systems - even if that were to happen they can easily re-verify your identity and issue you with a new password, and you really shouldn't be us…
It's a ridiculous practice and storing the passwords in plaintext is deplorable. Banks have your phone number, (which can't simply be changed online) and that is the best additional line of security. The scrambled on-screen keyboard / n-th character request only poorly "protects" against cases where the attacker has full root access to the customer's machine (how would it protect against phishing?), and in those case…
you know. It occurs to me that you could actually do this without storing the password in plaintext!
All you'd have to do is iterate every potential answer into a bloom filter and store that. The math gets a little hairy around the 50 character mark as you'd have 117600 operations to do to construct the bloom filter, and it gets worse if you expect more characters.
Here's how you would construct it.
For every 3 choose n of the password, insert a value of those 3 characters ("abc") + delimit (":") + the positions (1,2,4), You can't just insert the characters because the index of characters is part of the answer.
all you'd need to do is store... a ~1MB bloom filter per client. Huh, that number was bigger than I thought it would be.
Well nevermind. Fun thought though.
Re: The “Cobra Effect” that is disabling paste on password fields
#357TradeKing went full idiot and disabled entering your password by keyboard completely. They implemented an on-screen keyboard and there's no way to opt out. Their support forum is full of angry customers, people who can't use their screen readers anymore, etc. They argue [1] it's to protect their customers from key loggers. [1]: https://community.tradeking.com/forum/categories/suggestions...
Another one that is a great pain are the sites that insist upon asking for three letters from one's password to log in. This is all very well if one has an insecure password, but when I've created a 20-character password containing all the necessary characters then this makes it rather more difficult to enter the required values.
I actually like this as implemented by one of my banks. The 'pick a few letters' part of the login is pulled from a list of secret question answers rather than the password itself, and is presented after successfully entering the password.
So my password manager enters my password, and then on the next screen I am asked for the (for example) 4th and 5th letters of the street I grew up on. The requested letters change and the question is pulled from a saved list of question/answer pairs.
I am not aware of how the bank deals with accessibility limitations of this system.
Re: The “Cobra Effect” that is disabling paste on password fields
#358Earlier quoted context omitted.
HSBC has this really odd system where they only ask for the (e.g.) 1st, 6th, and 7th characters of your password. That implies that they store plaintext or something reversible...
Yes. This is to protect against attackers obtaining your full plaintext password on your end, for example by phishing or installing keyloggers. In practice this is a much bigger security threat in the online banking world than someone doing the same by compromising the bank's systems - even if that were to happen they can easily re-verify your identity and issue you with a new password, and you really shouldn't be us…
Except attackers usually get the passwords from other sites' databases that do the same thing and don't use proper backend hashing/salting
Re: The “Cobra Effect” that is disabling paste on password fields
#359Earlier quoted context omitted.
Not when they'd presumably lock the account for some period of time after a few failed attempts.
Password hashing is used to prevent the brute forcing when the attacker already has the copy of the password database, and is free from any failed attempt limits and timeouts. And in this case storing hashes of all 3-letter combos is basically useless, since all those hashes are very easy to bruteforce.
Ah ok, so you're starting from the assumption that the site has already been owned and the attacker has the hashed passwords. In which case yes, it does make it easier.
Re: The “Cobra Effect” that is disabling paste on password fields
#360There is a piece of terrible, unwarranted analysis in this article: > But there’s one angle to this that helps explain the madness and it goes back to that earlier PayPal screen grab. This was of the change password page, not the login page. You can easily paste into the login page and in fact you can even paste into the original password field on the change password page, just not the new password field or the other…
You know password managers don't make typo right?