Let them paste passwords (2017)
ncsc.gov.uk
Let them paste passwords (2017)
1–10 of 129 posts
Re: Let them paste passwords (2017)
#2Discussed quite a bit at the time: https://news.ycombinator.com/item?id=14366825
Re: Let them paste passwords (2017)
#3So much of main line security practice is cargo cultism. There is so little use of actual research and data on how compromises actually happen. Somebody just gets the idea something is good for security and it sticks. No rationale needed.
Re: Let them paste passwords (2017)
#4So much of main line security practice is cargo cultism. There is so little use of actual research and data on how compromises actually happen. Somebody just gets the idea something is good for security and it sticks. No rationale needed.
There's a lot of dogmatic cargo-culting elsewhere in software too, but it tends to get a lot more force behind it just because it's "for security".
Re: Let them paste passwords (2017)
#5Being a Firefox user, I have set dom.event.contextmenu.enabled and dom.event.clipboardevents.enabled set to false, so that I can continue right-clicking and pasting.
Re: Let them paste passwords (2017)
#6Being a Firefox user, I have set dom.event.contextmenu.enabled and dom.event.clipboardevents.enabled set to false, so that I can continue right-clicking and pasting.
Is there a way to quickly toggle those on and off?
Re: Let them paste passwords (2017)
#7Some password manager browser extensions circumvent password paste prevention, so that's worth looking into.
Re: Let them paste passwords (2017)
#8So much of main line security practice is cargo cultism. There is so little use of actual research and data on how compromises actually happen. Somebody just gets the idea something is good for security and it sticks. No rationale needed.
If you're pasting passwords into fields from a password manager, even if you paste it into the wrong place there is almost no chance of a real compromise. You have unique passwords everywhere, so a perpetrator would have to guess which of your hundreds of websites it is for.
Re: Let them paste passwords (2017)
#9My simple response. Stop using websites and apps that prevent pasting because it implies that the website or app has no idea how to secure their website or app properly.
Re: Let them paste passwords (2017)
#10Some password manager browser extensions circumvent password paste prevention, so that's worth looking into.
I've resorted to autohotkey keyboard shortcuts to simulate typing in credentials at times.
When I had to log into this one vpn for work I even used to have it open the 2fa app, click the button to copy the code, open the vpn app, enter all the fields, and log in all from one keyboard shortcut.