Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let them paste passwords (2017)

ncsc.gov.uk

Post reply on HN
Print view View original

71–80 of 129 posts

Re: Let them paste passwords (2017)

#71

Post by philsnow »

Instead of resorting to a browser extension[0], consider solving this with something like autohotkey, alfred, hammerspoon, etc.

This is my hammerspoon config that lets me do this, it's like 7 lines but could just as easily be 1 line: https://gist.github.com/philsnow/48ae8a31f7e063b23d4013470f0...

Benefit: works across all browsers, even daffy embedded (electron) ones where it's inconvenient to install extensions.

[0] every browser extension you install that has a broad permissions manifest is a liability; when they get popular, the authors start receiving offers of money from sketchy people in exchange for adding 'extra' bits of JS

Re: Let them paste passwords (2017)

#72

Post by iso1631 »

namdnay wrote: post #53
virgilp wrote: post #44

Earlier quoted context omitted.

You underestimate the ingenuity of some sites. Take this one: https://systemschimb.telekombanking.ro/login - enter a random user id, and behold the password input field: - all characters are separated (not one password field, but 10-15 ones) - some characters are randomly grayed-out (you're not supposed to enter all the characters of your password)

I like the system where you only enter parts of your password. It means that even with a key logger or hacked site, you’d need several logins to be able to scrape the password

That means the password is held in plain text or reversable encryption. They should only have a salted hash of your password.

Using a shared secret in addition to a salted password is probably acceptable, although how much extra security it gives is debatable.

Re: Let them paste passwords (2017)

#73

Post by viraptor »

mormegil wrote: post #70
nobatron wrote: post #61

Earlier quoted context omitted.

This approach also means that the password must be stored as plain text. Otherwise they would only be able to compare if the password was complete.

Not necessarily. You could store $10 \choose 5 = 252$ hashes for each user. We did something similar for call center caller authentication (you don't want the operator to get the whole PIN of the user, so he asked only for e.g. two characters). Not that this would be very useful, security-wise.

There are ready solutions for that too. For example https://github.com/bizley/yii2-partial-password

Re: Let them paste passwords (2017)

#74

Post by iso1631 »

wltprgm wrote: post #55

My piece of advie: Don't take your brain memory for granted In this era of information technology everyone is bombarded with tons of data that they don't know how to think and memorize Thinking and memorizing can strengthen your brain muscles but people hate exercising their bodies and their brains I do use keepass for managing different passwords, but I kind of memorize most of them, only open keepass for storing th…

How on earth could I remember random complex passwords I use once a year?

I can memorise af58f916cc0cb22193c18f02d3c1cc3e easily, but once you work out (perhaps a keylogger) why that's my paypal password, my google password of 68b31385067f73977c6007cefcddbe74 falls quickly

Re: Let them paste passwords (2017)

#75

Post by lukeramsden »

skrebbel wrote: post #41

I just wanna highlight how nice it is to see a government agency write such a clear, friendly, jargonless, blog-post-style piece of advisory. I hope this is a peek into the future of government communication everywhere.

For whatever weird reason, despite having completely incompetent governments since the appearance of the internet, our country has world-class digital services. The gov.uk design system[0] is a very good read, especially for people who aren't experienced in UX design.

[0] https://design-system.service.gov.uk/

Re: Let them paste passwords (2017)

#77

Post by viraptor »

monadic2 wrote: post #59
viraptor wrote: post #28

Earlier quoted context omitted.

> Security people have the same mindset. Security must be a hassle. It's an unhelpful generalisation. There are many jobs that could come under "Security people" and they work under different requirements. Many will agree with you on the hassle-free experience. There's no need for the us-vs-them.

Sure, but this isn’t engaging in the above poster in good faith.

I don't have the data on sales, so I can't comment on that. Without seeing the marketing, it's hard to tell why OP's solutions are not chosen. (I don't expect it to be as easy as "it's not difficult enough")

Re: Let them paste passwords (2017)

#78

Post by viraptor »

mmcnl wrote: post #76

I've never encountered a website that prevented me from pasting a password. Is this truly a thing?

https://www.ing.com.au/securebanking/ for example.

They even scramble the keypad and vary the last 2 bits of the colour, so you need to do an approximate match on the buttons. Still takes maybe 40 lines of python to automate the login.

Re: Let them paste passwords (2017)

#79

Post by viraptor »

wltprgm wrote: post #55

My piece of advie: Don't take your brain memory for granted In this era of information technology everyone is bombarded with tons of data that they don't know how to think and memorize Thinking and memorizing can strengthen your brain muscles but people hate exercising their bodies and their brains I do use keepass for managing different passwords, but I kind of memorize most of them, only open keepass for storing th…

My password manager has 429 entries right now. Maybe memorising is possible for some people who don't live and work on the internet every day. But I suspect most people in tech are in a similar position - unless you're into professional level scrabble, 429 random strings is too many.

Re: Let them paste passwords (2017)

#80

Post by tonyedgecombe »

lukeramsden wrote: post #75
skrebbel wrote: post #41

I just wanna highlight how nice it is to see a government agency write such a clear, friendly, jargonless, blog-post-style piece of advisory. I hope this is a peek into the future of government communication everywhere.

For whatever weird reason, despite having completely incompetent governments since the appearance of the internet, our country has world-class digital services. The gov.uk design system[0] is a very good read, especially for people who aren't experienced in UX design. [0] https://design-system.service.gov.uk/

A lot of the credit goes to Francis Maude[1], the only MP I've heard talk sensibly about software projects and development practices.

[1] https://en.wikipedia.org/wiki/Francis_Maude

Post reply on HN