Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We'd lose our security certificate if we allowed pasting

twitter.com

Post reply on HN
Print view View original

201–210 of 225 posts

Re: We'd lose our security certificate if we allowed pasting

#201

Post by KMag »

timdierks wrote: post #178

The tweeter (probably a non-technical support person, so go gently on him or her as an individual) has revised the statement: "@passy I'm mistaken about the website security certificate but avoiding pasting of passwords is good practice & protects our customers 1/2" https://twitter.com/BritishGasHelp/status/463679554306203648 "@passy especially when using public computers. Alpha numerical policy ensures your protecti…

Then they should clear the clipboard via JavaScript when submitting the login form, not prevent pasting of the password. Password managers are simply too much of a win to block.

Clearing the clipboard would be annoying for people who commonly copy a bunch of text out of a document, log in to their bank, and then paste the text somewhere else, but I suspect this is a rare workflow for most people.

Re: We'd lose our security certificate if we allowed pasting

#202

Post by KMag »

sp332 wrote: post #195
Zikes wrote: post #140

Earlier quoted context omitted.

Properly implemented parameterized SQL would allow '; drop table users; -- As a password without batting an eye.

But since you can't guarantee that every programmer and contractor, including future ones, write proper SQL, it's nice to reduce the attack surface a bit.

Reduce the attack surface by running the password through a proper modern Key Derivation Function (KDF) such as Scrypt before passing it to the database, not by running it through a few regexes.

Re: We'd lose our security certificate if we allowed pasting

#203

Post by freditup »

kevinburke wrote: post #177
freditup wrote: post #127

Earlier quoted context omitted.

I have Virgin Mobile in the US (it's one of the cheapest options with good quality phones), and it seems the same. It made me set a 6-digit PIN as my password, and my phone number is my username. Here are the requirements listed on their website: Your Account PIN must be: -6 numbers (no letters or special characters) -no more than 3 identical numbers in a row (222) -no more than 3 sequential numbers (such as 234) If…

Yeah, I wrote about this a few years ago and got a lot of press for it. They didn't really fix it, but at least they started rate limiting by IP address. https://kev.inburke.com/kevin/open-season-on-virgin-mobile-c...

Is rate limiting by IP the best way to handle something like this (other than the obvious, allowing better passwords)? You could obviously rate limit by account, but then you make it easy for anyone to lock anyone else out of their account. And obviously rate limiting by cookies as mentioned is awful.

Re: We'd lose our security certificate if we allowed pasting

#204

Post by reboog711 »

droope wrote: post #46
reboog711 wrote: post #37

To me this sounds like a crazy PCI Compliance related rule; and someone who doesn't understand anything about the PCI Compliance process or brute force hacking made the tweet. When I ran a web-site with an e-commerce store that accepted credit cards; I was required to have PCI Compliance scans done. One of the things they had me do was turn off the autocomplete on the password field with autocomplete="off". I have no…

autocomplete=off does not prevent you from using keepass, it prevents your browser from storing your password in your HD in plaintext. It's arguable that it's not the website's decision where the user caches it's passwords, but in high security environments I don't think it is an overkill.

That makes sense to me in a way I didn't think of before.

Re: We'd lose our security certificate if we allowed pasting

#205

Post by kevinburke »

freditup wrote: post #203
kevinburke wrote: post #177

Earlier quoted context omitted.

Yeah, I wrote about this a few years ago and got a lot of press for it. They didn't really fix it, but at least they started rate limiting by IP address. https://kev.inburke.com/kevin/open-season-on-virgin-mobile-c...

Is rate limiting by IP the best way to handle something like this (other than the obvious, allowing better passwords)? You could obviously rate limit by account, but then you make it easy for anyone to lock anyone else out of their account. And obviously rate limiting by cookies as mentioned is awful.

There's no great way to "handle" something like this besides modifying the protocol to be less vulnerable.

Re: We'd lose our security certificate if we allowed pasting

#206

Post by jamie_ca »

sehrope wrote: post #173
a_bonobo wrote: post #38

Earlier quoted context omitted.

Same goes for Virgin Mobile (at least here in Australia), which ALSO requires you to only use numbers. Last week they forced me to change my password due to an "important change" - ascending or descending numbers were not allowed anymore. I guess they had a look at their plain text password database and realized that 99% of their users used 123456. Edit: Australia seems to be using the US system: http://www.bitdefend…

Purely a guess but I think they only allow for numbers because it's a phone company. If they intend for people to enter their password/pin on their mobile phone then limiting it to only digits that you can type from any phone is understandable. Now I'm not saying it's a good idea but at least there is some sense to it. In no particular order my usual gripes with passwords and auth in general are: * Disabling clipboar…

Huh. I never actually did the math before, but: there's 32 symbols on my (US) keyboard. Upper+lower+number gives a baseline 62 characters. This gives us a password space for brute force attacks of

    10 char alphanum: 62^10, or 8.4e17
    10 char alnumsym: 94^10, or 5.4e19
    11 char alphanum: 62^11, or 5.2e19
One extra character instead of needing to type symbols into my phone, with nearly identical complexity? Sounds good to me.

Re: We'd lose our security certificate if we allowed pasting

#207

Post by CocaKoala »

Zikes wrote: post #140
tempodox wrote: post #131

Earlier quoted context omitted.

That was probably to prevent SQL injection, right?

Properly implemented parameterized SQL would allow '; drop table users; -- As a password without batting an eye.

hey man don't post my password here. Now I gotta change it again and I'm running out of good sql queries.

Re: We'd lose our security certificate if we allowed pasting

#209

Post by zaroth »

rwhitman wrote: post #192
timdierks wrote: post #178

The tweeter (probably a non-technical support person, so go gently on him or her as an individual) has revised the statement: "@passy I'm mistaken about the website security certificate but avoiding pasting of passwords is good practice & protects our customers 1/2" https://twitter.com/BritishGasHelp/status/463679554306203648 "@passy especially when using public computers. Alpha numerical policy ensures your protecti…

I did work for a very security-minded HR outsourcing company on an html site to be used on a public kiosk and we also disabled paste via javascript for the same reason - to prevent a user from being able to paste in a previous user's password at the same terminal.

Makes no sense at all... Where ELSE might I be able to paste the contents of my clipboard?

Now, clearing the clipboard AFTER pasting, that might actually make sense!

Re: We'd lose our security certificate if we allowed pasting

#210

Post by astrodust »

hluska wrote: post #155
fdej wrote: post #29

They probably hired the same security consultant as my bank, which requires your online password to be exactly six characters long. My hypothesis is that this is a technical limitation due to the password being stored as a char(6) in their database.

My bank enforces a six character limit and the passwords aren't even case sensitive. But, brace yourself to feel safe - they make me answer a security question (in this case, "What high school did you go to?" They made a (record) four billion dollar profit last year, so this strikes me as security designed by someone with an MBA and a spreadsheet. I'd be upset, but, I've been stupid enough to keep doing business with…

It's to the point where we have to invent fake identities for ourselves for authentication purposes.
Post reply on HN