Let them paste passwords (2017) • Hacker News Board

Re: Let them paste passwords (2017)

#31

Post by godot » Sat, Jun 20, 2020, 5:42 AM UTC

On this point:

> write passwords down in places that are easy to find (like post-it notes next to the screen)

Writing passwords on post-it notes is often used as a ridicule of non-tech-savvy folks behavior. I'd like to pose this question: If you're doing this not at an office, but at home, is this really so bad?

Say you run a web site on AWS and write your really long AWS password on a piece of paper at home. It would take a hacker finding out where you live and breaking into your house to find the piece of paper to access it. On the other hand, your ordinary neighborhood burglars typically care about cash and jewelry in your house, not post-it notes with passwords. It seems those two categories of intruders rarely overlap, unless you're a world famous target.

Re: Let them paste passwords (2017)

#32

Post by ramraj07 » Sat, Jun 20, 2020, 5:46 AM UTC

godot wrote: post #31

On this point: > write passwords down in places that are easy to find (like post-it notes next to the screen) Writing passwords on post-it notes is often used as a ridicule of non-tech-savvy folks behavior. I'd like to pose this question: If you're doing this not at an office, but at home, is this really so bad? Say you run a web site on AWS and write your really long AWS password on a piece of paper at home. It woul…

This is changing though. More and more people are becoming sufficiently savvy that if they find a password when they break in (and they're criminals to begin with), perhaps they can then try it with many common websites.

Re: Let them paste passwords (2017)

#33

Post by Gibbon1 » Sat, Jun 20, 2020, 5:48 AM UTC

jimmaswell wrote: post #10

zamalek wrote: post #7

Some password manager browser extensions circumvent password paste prevention, so that's worth looking into.

I've resorted to autohotkey keyboard shortcuts to simulate typing in credentials at times. When I had to log into this one vpn for work I even used to have it open the 2fa app, click the button to copy the code, open the vpn app, enter all the fields, and log in all from one keyboard shortcut.

I've long thought you should be able to use a hot key + insecure password to generate a strong time limited password. Insecure password could be just the website domain name for all it matters.

You can have the keyboard handle everything

Re: Let them paste passwords (2017)

#34

Post by Gibbon1 » Sat, Jun 20, 2020, 5:57 AM UTC

godot wrote: post #31

On this point: > write passwords down in places that are easy to find (like post-it notes next to the screen) Writing passwords on post-it notes is often used as a ridicule of non-tech-savvy folks behavior. I'd like to pose this question: If you're doing this not at an office, but at home, is this really so bad? Say you run a web site on AWS and write your really long AWS password on a piece of paper at home. It woul…

One solution is to use an easy to remember prefix with your passwords and only write down the secure part.

Password is mayfly-DyHpE82sd3r3rvr!2sDQ

Part you write down is DyHpE82sd3r3rvr!2sDQ

Re: Let them paste passwords (2017)

#35

Post by viraptor » Sat, Jun 20, 2020, 6:05 AM UTC

godot wrote: post #31

On this point: > write passwords down in places that are easy to find (like post-it notes next to the screen) Writing passwords on post-it notes is often used as a ridicule of non-tech-savvy folks behavior. I'd like to pose this question: If you're doing this not at an office, but at home, is this really so bad? Say you run a web site on AWS and write your really long AWS password on a piece of paper at home. It woul…

The threat model is always important. What does your home look like? Who are you protecting from? If your current home is a shared student accommodation, post-its are probably a bad idea. If you live with potentially abusive family members, it may be a bad idea.

But in many cases when you don't live your life online and login everywhere with your Google account federation - sure write it on a post-it. It's not good enough though if you have 20+ accounts and would make you share a password between them.

Re: Let them paste passwords (2017)

#36

Post by viraptor » Sat, Jun 20, 2020, 6:10 AM UTC

ramraj07 wrote: post #32

godot wrote: post #31

On this point: > write passwords down in places that are easy to find (like post-it notes next to the screen) Writing passwords on post-it notes is often used as a ridicule of non-tech-savvy folks behavior. I'd like to pose this question: If you're doing this not at an office, but at home, is this really so bad? Say you run a web site on AWS and write your really long AWS password on a piece of paper at home. It woul…

This is changing though. More and more people are becoming sufficiently savvy that if they find a password when they break in (and they're criminals to begin with), perhaps they can then try it with many common websites.

Have you got any evidence for it? There's next to no monetary gain from any online account and even breaking into someone's bank online means you need to find a way to transfer money without leaving a trace and without extra transfer validation. Who would trade an extra minute when they can get caught for a random password?

Re: Let them paste passwords (2017)

#37

Post by callalex » Sat, Jun 20, 2020, 6:10 AM UTC

tony-allan wrote: post #9

My simple response. Stop using websites and apps that prevent pasting because it implies that the website or app has no idea how to secure their website or app properly.

The web is unfortunately too ubiquitous for this approach. If I get hired by someone, I have to use the website they chose for pay stubs, or health insurance descriptions, or direct deposit configuration, or stock option distribution, or many other life-essential services that an individual has absolutely no control of. Sure I can complain to HR, but it will fall on deaf ears that were sold by a shitty SaaS pitch that made some loser’s life mildly easier in return for a subscription payment.

And that’s not even touching all of the government websites that behave in this way.

Re: Let them paste passwords (2017)

#38

Post by viraptor » Sat, Jun 20, 2020, 6:12 AM UTC

RyanShook wrote: post #19

What password manager do you use? Have been using Avast PW Manager but appears to no longer be maintained.

Bitwarden is a good open solution (with usual extensions and mobile apps). You can host the server part yourself too.

Re: Let them paste passwords (2017)

#39

Post by mrtnmcc » Sat, Jun 20, 2020, 6:15 AM UTC

geofft wrote: post #12

mrtnmcc wrote: post #11

Seems a plausible concern that malware on the PC can access the clipboard, so they discourage copying their password into clipboard. But intercepting keystrokes to another program (at least in Windows) doesn't require any special permissions either. Would the concern more be background web tabs (cross-site) accessing the global clipboard? Vaguely recall that was possible a long time ago but likely locked down now.

As the article points out, for malicious sites that was true on IE 6 but no longer, and for malicious local software you have bigger problems.

Thanks, didn't notice the popouts in the page. That's right.. IE6 was the menace.

Re: Let them paste passwords (2017)

#40

Post by dheera » Sat, Jun 20, 2020, 6:17 AM UTC

jiggawatts wrote: post #14

Making password entry difficult is like attempting weight loss by eating bland food. It's not the flavour that makes you fat. Nonetheless, there's this perception that something delicious can't be good for a diet. People have this notion that to lose weight, there must be penance . An element of punishing oneself for past transgressions seems essential . Security people have the same mindset. Security must be a hassl…

apt-get install xclip xdotool, then put this in ~/bin/paste

    #!/bin/bash
    sleep 2.0
    xdotool type "$(xclip -o -selection clipboard)"

If a website prevents you from pasting stuff just type "paste" and then click the field and wait 2 seconds.