Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The “Cobra Effect” that is disabling paste on password fields

troyhunt.com

Post reply on HN
Print view View original

11–20 of 450 posts

Re: The “Cobra Effect” that is disabling paste on password fields

#11

Post by dkbrk »

lstamour wrote: post #2

Great article. The only point missed is that password length limits AND re-type fields AND disabling copy and paste are all measures that when, implemented correctly, are supposed to help you remember your password and prevent easy access to reset mechanisms by forcing you to type it twice and not accidentally copy and paste it twice. Of course, in an era where weak password re-use and leaked hashes are one of the bi…

I understand the desire to stop stupid users from being stupid, however outright preventing user best practice unless they resort to somewhat exotic workarounds is completely inexcusable.

> we really should re-evaluate all the above assumptions

I would not consider anyone supporting these practices remotely competent. There should not be any need to re-evaluate anything.

Re: The “Cobra Effect” that is disabling paste on password fields

#12

Post by morgante »

level3 wrote: post #5

I always assumed it was for the same reason sites make you enter your email address twice without pasting - to reduce the chance of mistyping. If you only have to enter something once, then you could easily mistype it and then you end up with an account you can't log in to or even recover. But if you have to type it twice, then the chance is greatly reduced, since you'd have to make the exact same typo twice in a row…

That's still not a very good reason.

If you're security conscious, you shouldn't be typing passwords at all. You should generate them from a password manager and paste them into the field both times.

It boils down to security theater making us all less secure.

Re: The “Cobra Effect” that is disabling paste on password fields

#13

Post by fit2rule »

One reason to dissuade users from using the clipboard to paste passwords is this: the password stays in the clipboard.

Not all users realize this, and so .. don't 'clear' the clipboard after logging in .. which means their password is still available to anyone else who might use that computer.

Re: The “Cobra Effect” that is disabling paste on password fields

#14

Post by morgante »

lstamour wrote: post #2

Great article. The only point missed is that password length limits AND re-type fields AND disabling copy and paste are all measures that when, implemented correctly, are supposed to help you remember your password and prevent easy access to reset mechanisms by forcing you to type it twice and not accidentally copy and paste it twice. Of course, in an era where weak password re-use and leaked hashes are one of the bi…

> remember your password

Starting with the premise that users should be remembering passwords at all is a mistake.

Re: The “Cobra Effect” that is disabling paste on password fields

#15

Post by morgante »

The worst is websites which not only disable pasting but don't even let you type your password in. Instead you have to use their janky on-screen keyboard to fumble your way through login.

I got so fed up with TradeKing (which has horrible security practices in general) that I close my account.

Re: The “Cobra Effect” that is disabling paste on password fields

#17

Post by madeofpalk »

morgante wrote: post #12
level3 wrote: post #5

I always assumed it was for the same reason sites make you enter your email address twice without pasting - to reduce the chance of mistyping. If you only have to enter something once, then you could easily mistype it and then you end up with an account you can't log in to or even recover. But if you have to type it twice, then the chance is greatly reduced, since you'd have to make the exact same typo twice in a row…

That's still not a very good reason. If you're security conscious, you shouldn't be typing passwords at all. You should generate them from a password manager and paste them into the field both times. It boils down to security theater making us all less secure.

Not concerned about security, but about the direct user experience. The user won't know that they've mistyped their password, won't potentially won't return when they can't log into their account.

Re: The “Cobra Effect” that is disabling paste on password fields

#18

Post by level3 »

morgante wrote: post #12
level3 wrote: post #5

I always assumed it was for the same reason sites make you enter your email address twice without pasting - to reduce the chance of mistyping. If you only have to enter something once, then you could easily mistype it and then you end up with an account you can't log in to or even recover. But if you have to type it twice, then the chance is greatly reduced, since you'd have to make the exact same typo twice in a row…

That's still not a very good reason. If you're security conscious, you shouldn't be typing passwords at all. You should generate them from a password manager and paste them into the field both times. It boils down to security theater making us all less secure.

As someone running a user-facing site, you cannot control whether your users use password managers. So what's your solution? Just disregard the segment of your users who don't use password managers? That's a tradeoff that you might not want to make, depending on your business.

Also, if you're someone who uses a password manager, does disabling pasting really make you less secure? I assume you're still generating passwords; you just have to retype them. So maybe less convenient, but less secure is kind of a stretch. (By the way, I personally use KeePass, and I generally use auto-type instead of pasting, so I'm not inconvenienced at all.)

Re: The “Cobra Effect” that is disabling paste on password fields

#19

Post by lisivka »

fit2rule wrote: post #13

One reason to dissuade users from using the clipboard to paste passwords is this: the password stays in the clipboard. Not all users realize this, and so .. don't 'clear' the clipboard after logging in .. which means their password is still available to anyone else who might use that computer.

So, login form can just clear clipboard instead in onsubmit() handler.

Re: The “Cobra Effect” that is disabling paste on password fields

#20

Post by raldi »

level3 wrote: post #18
morgante wrote: post #12

Earlier quoted context omitted.

That's still not a very good reason. If you're security conscious, you shouldn't be typing passwords at all. You should generate them from a password manager and paste them into the field both times. It boils down to security theater making us all less secure.

As someone running a user-facing site, you cannot control whether your users use password managers. So what's your solution? Just disregard the segment of your users who don't use password managers? That's a tradeoff that you might not want to make, depending on your business. Also, if you're someone who uses a password manager, does disabling pasting really make you less secure? I assume you're still generating pass…

> So what's your solution?

Allow pasted passwords if they meet a very high password-quality heuristic; deny them if they seem too guessable.

Post reply on HN