I just wanna highlight how nice it is to see a government agency write such a clear, friendly, jargonless, blog-post-style piece of advisory.
I hope this is a peek into the future of government communication everywhere.
Let them paste passwords (2017)
41–50 of 129 posts
Re: Let them paste passwords (2017)
#42So much of main line security practice is cargo cultism. There is so little use of actual research and data on how compromises actually happen. Somebody just gets the idea something is good for security and it sticks. No rationale needed.
Related to this, every security team I’ve ever interacted with barely knows how to work a computer and mostly operates off of commercially purchased scanning tools and security agents. My theory is that security is the least desirable part of the entire software engineering stack - it’s boring, has a lot of blame and liability potential, and it’s a cost center. Heck at least infrastructure folks get to brag about thi…
I recently started a CISSP course and discovered this. I was so excited to finally be getting into security and the next thing I know I'm 3 hours into recordings about pointless jargon and control taxonomies. I know there is a place for the latter at least, but it isn't something I want to do everyday.
Re: Let them paste passwords (2017)
#43Making password entry difficult is like attempting weight loss by eating bland food. It's not the flavour that makes you fat. Nonetheless, there's this perception that something delicious can't be good for a diet. People have this notion that to lose weight, there must be penance . An element of punishing oneself for past transgressions seems essential . Security people have the same mindset. Security must be a hassl…
The security industry is a high paid specialization in an already highly paid industry, and it attracts an enormous number of complete charlatans. It’s incredibly easy to be a security charlatan, most of the people you work with won’t understand what it is you’re supposed to be doing, so they won’t know any better when you tell them to do literally anything at all. You can create an endless stream of busywork for yourself, by making an endless stream of nonsensical risk assessments, and anytime you don’t know what to do you can just say no. Anytime you’re questioned you can just say it’s best practice, and chances are some authority at some point in time said it was.
Other risk-related fields typically have at least some of the same issues. Risk avoidance is always a no-effort strategy, and the industry is full of people who rely on it entirely, because they don’t have the skills to implement actual mitigation strategies.
Re: Let them paste passwords (2017)
#44Making password entry difficult is like attempting weight loss by eating bland food. It's not the flavour that makes you fat. Nonetheless, there's this perception that something delicious can't be good for a diet. People have this notion that to lose weight, there must be penance . An element of punishing oneself for past transgressions seems essential . Security people have the same mindset. Security must be a hassl…
apt-get install xclip xdotool, then put this in ~/bin/paste #!/bin/bash sleep 2.0 xdotool type "$(xclip -o -selection clipboard)" If a website prevents you from pasting stuff just type "paste" and then click the field and wait 2 seconds.
You underestimate the ingenuity of some sites.
Take this one: https://systemschimb.telekombanking.ro/login - enter a random user id, and behold the password input field:
- all characters are separated (not one password field, but 10-15 ones)
- some characters are randomly grayed-out (you're not supposed to enter all the characters of your password)
Re: Let them paste passwords (2017)
#45Earlier quoted context omitted.
Why do you need to toggle them? Isn't pasting and right clicking useful everywhere?
Some SPAs and other sites have useful right click actions that I want to preserve. Does this setting disable those? (For the pasting, I agree with you. I can't think of a single reason I'd want a website to prevent me from pasting)
You do not end up losing those. Both the popup menus - the site's as well as the browser's - are shown, the latter on top of the former. Press Esc to make your browser's vanish, and you still have the site's available.
Re: Let them paste passwords (2017)
#46Earlier quoted context omitted.
Some SPAs and other sites have useful right click actions that I want to preserve. Does this setting disable those? (For the pasting, I agree with you. I can't think of a single reason I'd want a website to prevent me from pasting)
You do not end up losing those. Both the popup menus - the site's as well as the browser's - are shown, the latter on top of the former. Press Esc to make your browser's vanish, and you still have the site's available.
Thanks. I just toggled both of those settings.
Re: Let them paste passwords (2017)
#47Being a Firefox user, I have set dom.event.contextmenu.enabled and dom.event.clipboardevents.enabled set to false, so that I can continue right-clicking and pasting.
I recommend checking out the "Don't F$#k with Paste" extension which allows you to essentially control the setting per site: https://addons.mozilla.org/firefox/addon/don-t-fuck-with-pas... There is also a version for Chrome: https://chrome.google.com/webstore/detail/dont-fuck-with-pas... EDIT: Made the link locale independent and censored the name better.
> censored the name better
Good thing we can't fucking see the 'fuck' in the name and just in the urls, that would have been mother fucking mayhem.
Re: Let them paste passwords (2017)
#48I just wanna highlight how nice it is to see a government agency write such a clear, friendly, jargonless, blog-post-style piece of advisory. I hope this is a peek into the future of government communication everywhere.
In general the UK government websites are excellent. They have a largely consistent UI, good use of links, and straightforward prose. An example picked at random:
Re: Let them paste passwords (2017)
#49My simple response. Stop using websites and apps that prevent pasting because it implies that the website or app has no idea how to secure their website or app properly.
That's the 'just move' argument and it doesn't make any more sense here than it does in other contexts