Let them paste passwords (2017) • Hacker News Board

Re: Let them paste passwords (2017)

#61

Post by nobatron » Sat, Jun 20, 2020, 8:27 AM UTC

virgilp wrote: post #44

dheera wrote: post #40

Earlier quoted context omitted.

apt-get install xclip xdotool, then put this in ~/bin/paste #!/bin/bash sleep 2.0 xdotool type "$(xclip -o -selection clipboard)" If a website prevents you from pasting stuff just type "paste" and then click the field and wait 2 seconds.

You underestimate the ingenuity of some sites. Take this one: https://systemschimb.telekombanking.ro/login - enter a random user id, and behold the password input field: - all characters are separated (not one password field, but 10-15 ones) - some characters are randomly grayed-out (you're not supposed to enter all the characters of your password)

This approach also means that the password must be stored as plain text. Otherwise they would only be able to compare if the password was complete.

Re: Let them paste passwords (2017)

#62

Post by ownagefool » Sat, Jun 20, 2020, 8:31 AM UTC

AmericanChopper wrote: post #43

jiggawatts wrote: post #14

Making password entry difficult is like attempting weight loss by eating bland food. It's not the flavour that makes you fat. Nonetheless, there's this perception that something delicious can't be good for a diet. People have this notion that to lose weight, there must be penance . An element of punishing oneself for past transgressions seems essential . Security people have the same mindset. Security must be a hassl…

The security industry is a high paid specialization in an already highly paid industry, and it attracts an enormous number of complete charlatans. It’s incredibly easy to be a security charlatan, most of the people you work with won’t understand what it is you’re supposed to be doing, so they won’t know any better when you tell them to do literally anything at all. You can create an endless stream of busywork for you…

Yeah I'm a contractor that basically works on modernising the SDLC and target platforms. Nothing fancy.

Pretty much in all circumstances the outright adversary is Enterprise Architecture or Security using governance and security to push complex standards that don't work and result making changes harder and unpatched systems.

Some of them are receptive if you communicate the issues in terms of risk, but many most in my experience are only receptive if put it in writing and you copy in their boss.

Re: Let them paste passwords (2017)

#63

Post by kybernetikos » Sat, Jun 20, 2020, 8:52 AM UTC

godot wrote: post #31

On this point: > write passwords down in places that are easy to find (like post-it notes next to the screen) Writing passwords on post-it notes is often used as a ridicule of non-tech-savvy folks behavior. I'd like to pose this question: If you're doing this not at an office, but at home, is this really so bad? Say you run a web site on AWS and write your really long AWS password on a piece of paper at home. It woul…

Big problem is that if you have a break in you don't know if the theif was tech savvy or not, and you should assume your passwords are compromised.

Re: Let them paste passwords (2017)

#64

Post by gorgoiler » Sat, Jun 20, 2020, 8:55 AM UTC

Ahhh, guess the age of the graffiti. Far more likely, these days:

  const q = document.querySelector;
  q(‘#password’).onpaste = e => e.preventDefault();

Re: Let them paste passwords (2017)

#65

Post by PeterisP » Sat, Jun 20, 2020, 9:17 AM UTC

kybernetikos wrote: post #63

godot wrote: post #31

On this point: > write passwords down in places that are easy to find (like post-it notes next to the screen) Writing passwords on post-it notes is often used as a ridicule of non-tech-savvy folks behavior. I'd like to pose this question: If you're doing this not at an office, but at home, is this really so bad? Say you run a web site on AWS and write your really long AWS password on a piece of paper at home. It woul…

Big problem is that if you have a break in you don't know if the theif was tech savvy or not, and you should assume your passwords are compromised.

Break ins are rare (I mean, most people will never have one in their lives); and if your threat model assumes have a tech-savvy thief then all your accounts should be considered compromised anyway since it's likely that some of the stolen devices will include some access tokens/cookies that could grant access to some accounts which then can be escalated to e.g. reset passwords to other accounts.

Re: Let them paste passwords (2017)

#66

Post by phit_ » Sat, Jun 20, 2020, 9:20 AM UTC

virgilp wrote: post #44

dheera wrote: post #40

Earlier quoted context omitted.

apt-get install xclip xdotool, then put this in ~/bin/paste #!/bin/bash sleep 2.0 xdotool type "$(xclip -o -selection clipboard)" If a website prevents you from pasting stuff just type "paste" and then click the field and wait 2 seconds.

You underestimate the ingenuity of some sites. Take this one: https://systemschimb.telekombanking.ro/login - enter a random user id, and behold the password input field: - all characters are separated (not one password field, but 10-15 ones) - some characters are randomly grayed-out (you're not supposed to enter all the characters of your password)

the page uses vue and its in development mode, just wow

https://i.imgur.com/87Z46vb.png

Re: Let them paste passwords (2017)

#67

Post by ArgyleSound » Sat, Jun 20, 2020, 9:22 AM UTC

namdnay wrote: post #53

virgilp wrote: post #44

Earlier quoted context omitted.

You underestimate the ingenuity of some sites. Take this one: https://systemschimb.telekombanking.ro/login - enter a random user id, and behold the password input field: - all characters are separated (not one password field, but 10-15 ones) - some characters are randomly grayed-out (you're not supposed to enter all the characters of your password)

I like the system where you only enter parts of your password. It means that even with a key logger or hacked site, you’d need several logins to be able to scrape the password

Yet it also suggests the password is being stored insecurely in the server.

Re: Let them paste passwords (2017)

#68

Post by mnw21cam » Sat, Jun 20, 2020, 9:27 AM UTC

godot wrote: post #31

On this point: > write passwords down in places that are easy to find (like post-it notes next to the screen) Writing passwords on post-it notes is often used as a ridicule of non-tech-savvy folks behavior. I'd like to pose this question: If you're doing this not at an office, but at home, is this really so bad? Say you run a web site on AWS and write your really long AWS password on a piece of paper at home. It woul…

Just make sure you don't accidentally broadcast your most valuable passwords over your video conference.

Re: Let them paste passwords (2017)

#69

Post by floatingsmoke » Sat, Jun 20, 2020, 9:27 AM UTC

Also let them fill their credentials in a single form. Two-step login makes password managers experience terrible.

Re: Let them paste passwords (2017)

#70

Post by mormegil » Sat, Jun 20, 2020, 9:27 AM UTC

nobatron wrote: post #61

virgilp wrote: post #44

Earlier quoted context omitted.

You underestimate the ingenuity of some sites. Take this one: https://systemschimb.telekombanking.ro/login - enter a random user id, and behold the password input field: - all characters are separated (not one password field, but 10-15 ones) - some characters are randomly grayed-out (you're not supposed to enter all the characters of your password)

This approach also means that the password must be stored as plain text. Otherwise they would only be able to compare if the password was complete.

Not necessarily. You could store $10 \choose 5 = 252$ hashes for each user.

We did something similar for call center caller authentication (you don't want the operator to get the whole PIN of the user, so he asked only for e.g. two characters). Not that this would be very useful, security-wise.