I get the meaning of the "Cobra Effect", but I'm not understanding it here w.r.t. disabling paste on password fields.
The “Cobra Effect” that is disabling paste on password fields
361–370 of 450 posts
Re: The “Cobra Effect” that is disabling paste on password fields
#362Re: The “Cobra Effect” that is disabling paste on password fields
#363Earlier quoted context omitted.
They also have the silly "Security Image" which is supposed to alert me to a phishing site because I'm supposed to notice its absence. I'm guessing that's been effective roughly never.
Any idea how it works and what makes it (supposedly) impossible for a phishing site to copy?
I think Yahoo used to (maybe still does?) set it in a cookie, letting the browser's same-origin policy enforce it.
Re: The “Cobra Effect” that is disabling paste on password fields
#364Earlier quoted context omitted.
The annoying one on iOS is how often it makes me re-enter my Apple ID password. In a modal, of course, so it's impossible to bounce out to 1Password to copy the (very long and complex) password without dismissing the modal first. Sometimes I'll get a "re-enter your apple id password" modal at some random time while I'm doing something else, dismiss it to go get the password, and then have no idea how to get it back b…
> re-enter my Apple ID password I find it absolutely infuriating that this is necessary even when "purchasing" a free app. The #1 reason I will not buy an app is because I do not want to deal with entering my Apple ID password yet another goddamn time . If your phone shuts all the way down with any regularity, it's a nightmare.
You haven't had to enter a password for free apps for a while now - maybe it's a preference somewhere?
Re: The “Cobra Effect” that is disabling paste on password fields
#365Earlier quoted context omitted.
> three letters from one's password to log in Could you explain how this works? I've never ran into this and I'm curious as to what it solves / they claim it solves.
I think GP is referring to the practice of asking you to type some amount of random characters from your password. It seems to be popular with banks nowadays. The field looks like this: [ ][X][X][ ][X][X][ ][X][ ][X][X][ ][ ][X][ ] (you enter characters in the blanks) The idea is supposedly to protect people from keyloggers. But the side effect is that more sophisticated passwords get excruciatingly annoying to type…
Doesn't this also imply that the bank is storing plaintext passwords instead of salted hashes? I'm pretty sure I would not use such a bank.
Edit: Just saw that others have already brought this up below. Sorry for the redundancy.
Re: The “Cobra Effect” that is disabling paste on password fields
#366Fortunately, it's not hard to get around this on desktop (for Mac at least) with an applet like Paste Typer. But when I see this on iOS it infuriates me. I use 1Password to generate strong (long) passwords and having to type them out manually is a huge PIA.
I have a Microsoft touch mouse, and I can program macros on the touchpad's regions. So if I press the top/middle part of the thing, it just types my password :) In fact, now that I'm thinking of it, I can use it to trigger a script which will type whatever is in the clipboard. Silly javascript script kiddies think they can control a user's behavior like this.
Passwords are like underwear - sharing them is a really bad idea. You shouldn't have 'a' password - every site should have a unique one.
Re: The “Cobra Effect” that is disabling paste on password fields
#367Earlier quoted context omitted.
Oh good so I'm not alone! I tried setting it up but trying to mass import multiple passwords from KeePass over (which doesn't translate directly 1 to 1) left me manually entering them. The process was so incredibly slow and cumbersome that I gave up. It doesn't help that LastPass looks like it was created in 2003 by developers with zero UX / design talent. I hope they can improve that one day.
When did you try it? It very recently went through a total ux overhaul. Big improvement imo.
About 6 months ago. Perhaps I'll take another look but I haven't heard good things from anyone I know who uses it.
Re: The “Cobra Effect” that is disabling paste on password fields
#368Until better minds prevail.., Disable JavaScript, paste password, enable JavaScript, login. A pain, but usually effective.
Unless the login page needs JavaScript to work (like SPA)
No, this should still work. Kid the page, let JavaScript run. Kill js, paste your password, then re-enable js before hitting submit
Re: The “Cobra Effect” that is disabling paste on password fields
#369I doubt that the motivation for preventing paste in a "confirm password" context is to prevent workarounds to character limits. Why does the "confirm password" field exist anyway? It exists to remove the risk of input error. They want to avoid you locking into a mistyped password and not being able to recover. To this end, it makes some sense to prevent copy/paste, as a user may simply copy their mistyped password an…
This raises the interesting question of why we obscure the input when changing passwords. Showing the new password would allow people to check and correct it, so you'd only need one input.
Given that the contents of a password input can easily be revealed, the only security obscuring the input provides is from an attacker who can see the screen but not the keyboard, and has no physical access to the device - a pretty limited threat pool.
I guess the answer is that users expect passwords to be hidden. So we make their lives more difficult purely to keep them happy.
Re: The “Cobra Effect” that is disabling paste on password fields
#370Earlier quoted context omitted.
How would you prevent a client from logging in from an infected system?
That's not really the point, it is more of a comment on that there's no point in assisting it.
Yeah, but according to the reaction, usability outweighs minimal security in this case. Although keyloggers cannot be used anymore, RAM-scraping is still possible. Simply scan the browser's memory for URL query strings and POST bodies and you're done - even works with HTTPS pages.