Let them paste passwords (2017)

Post by user5994461 » Sat, Jun 20, 2020, 1:37 PM UTC

megapatch wrote: post #58

virgilp wrote: post #44

Earlier quoted context omitted.

You underestimate the ingenuity of some sites. Take this one: https://systemschimb.telekombanking.ro/login - enter a random user id, and behold the password input field: - all characters are separated (not one password field, but 10-15 ones) - some characters are randomly grayed-out (you're not supposed to enter all the characters of your password)

It is missfeatures like this which make me seriously doubt the competence of the site provider. They then loose me as a customer, and everybody else who I can influence.

Post by SCHiM » Sat, Jun 20, 2020, 1:49 PM UTC

sl1ck731 wrote: post #42

dangus wrote: post #26

Earlier quoted context omitted.

Related to this, every security team I’ve ever interacted with barely knows how to work a computer and mostly operates off of commercially purchased scanning tools and security agents. My theory is that security is the least desirable part of the entire software engineering stack - it’s boring, has a lot of blame and liability potential, and it’s a cost center. Heck at least infrastructure folks get to brag about thi…

I recently started a CISSP course and discovered this. I was so excited to finally be getting into security and the next thing I know I'm 3 hours into recordings about pointless jargon and control taxonomies. I know there is a place for the latter at least, but it isn't something I want to do everyday.

Post by kchr » Sat, Jun 20, 2020, 2:25 PM UTC

dheera wrote: post #40

jiggawatts wrote: post #14

Making password entry difficult is like attempting weight loss by eating bland food. It's not the flavour that makes you fat. Nonetheless, there's this perception that something delicious can't be good for a diet. People have this notion that to lose weight, there must be penance . An element of punishing oneself for past transgressions seems essential . Security people have the same mindset. Security must be a hassl…

apt-get install xclip xdotool, then put this in ~/bin/paste #!/bin/bash sleep 2.0 xdotool type "$(xclip -o -selection clipboard)" If a website prevents you from pasting stuff just type "paste" and then click the field and wait 2 seconds.

Post by pbhjpbhj » Sat, Jun 20, 2020, 2:55 PM UTC

PeterisP wrote: post #65

kybernetikos wrote: post #63

Earlier quoted context omitted.

Big problem is that if you have a break in you don't know if the theif was tech savvy or not, and you should assume your passwords are compromised.

Break ins are rare (I mean, most people will never have one in their lives); and if your threat model assumes have a tech-savvy thief then all your accounts should be considered compromised anyway since it's likely that some of the stolen devices will include some access tokens/cookies that could grant access to some accounts which then can be escalated to e.g. reset passwords to other accounts.

Post by bad_user » Sat, Jun 20, 2020, 3:08 PM UTC

jiggawatts wrote: post #14

Making password entry difficult is like attempting weight loss by eating bland food. It's not the flavour that makes you fat. Nonetheless, there's this perception that something delicious can't be good for a diet. People have this notion that to lose weight, there must be penance . An element of punishing oneself for past transgressions seems essential . Security people have the same mindset. Security must be a hassl…