Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let them paste passwords

ncsc.gov.uk

Post reply on HN
Print view View original

101–110 of 376 posts

Re: Let them paste passwords

#101

Post by makmanalp »

jameshart wrote: post #84
joshvm wrote: post #78

Earlier quoted context omitted.

We had a gem at my last university (UCL): you must rotate your password every few months, your password can't be anything like any of the previous ones (i.e. previous ones are stored, and they're not hashed), your password must contain special characters etc. Except.. it can only be 8 characters long. Anything else gets truncated (they explicitly said so). The mind boggles. I have no idea where this limitation comes…

> your password can't be anything like any of the previous ones (i.e. they're not stored hashed) That's... not necessarily the case. You can implement that check by only storing hashes of previous passwords, or of patterns derived form them that are also forbidden (e.g. store a bcrypt of every previous password converted to all lowercase and with numbers and symbols removed).

Doesn't that decrease the benefit of storing a hash? You probably know the process through which the derivative hashes are generated, which is not known-plaintext but seems kinda iffy still.

Re: Let them paste passwords

#102

Post by chefandy »

criddell wrote: post #76
thesuitonym wrote: post #58

Earlier quoted context omitted.

Other signs that a site was built by incompetent developers (Or had too much management interference--Devs aren't always to blame!): Only works with Internet Explorer Doesn't work with Internet Explorer Password must have one of 4-10 special characters, but not other special characters. (e.g.: Must contain !, @, ^, &, or parentheses, but not ;, ", etc) Passwords have no requirements Right-click is disabled Video play…

How about case insensitive passwords? That one always bugs me because it suggests that maybe they are storing the password.

I've seen people write hash functions which change the input to all lower or upper case first. I think it's a pointless, stupid idea– maybe unless it's a VERY low-risk system for people with cognitive disabilities, kids or seniors– but not necessarily unhashed-password-level stupid.

Re: Let them paste passwords

#103

Post by pmontra »

ErrantX wrote: post #82
artursapek wrote: post #4

Of course it reduces security. It makes you resort to either 1.) typing it out manually while you can't see if you made a mistake 2.) using developer tools to set the 'value' attribute directly "SPP" discourages use of a password manager. End of story. I also see this pattern used on banking websites for inputs like an account number. This drives me crazy as well for the same reason. The computer can get it right mor…

It's interesting that a lot of us are assuming that pasting encourages the use of password managers. However; I worry that this is a very BIG assumption. Even in my IT-literate circles password management usage is low. In my non-IT circles it is non-existent, and not because of SPP particularly; I suspect SPP (which I agree is silly) derived from an understanding that allowing an average person to paste passwords mea…

I assume that those people still use a passwords.txt and type the passwords in it, or they use only one password for all the sites. So SPP doesn't change anything for them but it makes switching them to a password manager more difficult.

Re: Let them paste passwords

#104

Post by pmontra »

jmkni wrote: post #83
artursapek wrote: post #4

Of course it reduces security. It makes you resort to either 1.) typing it out manually while you can't see if you made a mistake 2.) using developer tools to set the 'value' attribute directly "SPP" discourages use of a password manager. End of story. I also see this pattern used on banking websites for inputs like an account number. This drives me crazy as well for the same reason. The computer can get it right mor…

I use a password manager to generate long, complex passwords for every service I use (as complex as the service will allow). For sites that disable pasting, I have developed quite a skill at copying the password character by character from my PM into the password field. I'm even starting to remember a couple of them. Incredibly frustrating.

Sometimes I open the developer tools and paste the password in the value of the input element there. It usually works.

Re: Let them paste passwords

#105

Post by akubera »

artursapek wrote: post #80
majewsky wrote: post #62

Earlier quoted context omitted.

I'd actually like an extension along the lines of "This is not Google Docs, for fuck's sake", that just disables all these APIs that are only ever useful with rich apps, but not with content-heavy websites, for example: - copy/paste hijacking - sensor access: microphone, camera, GPS, etc. Maybe even go further and introduce some sort of rate-limiting for - XHR requests - relayout events to save power and data.

Incidentally, what are these APIs? I am building a rich content app (SVG editor) and have been starting to think about what copy + paste will look like.

I think you want to investigate the "ClipboardEvent" web API. Try starting here: https://developer.mozilla.org/en-US/docs/Web/API/ClipboardEv...

Re: Let them paste passwords

#106

Post by bradleyjg »

artursapek wrote: post #4

Of course it reduces security. It makes you resort to either 1.) typing it out manually while you can't see if you made a mistake 2.) using developer tools to set the 'value' attribute directly "SPP" discourages use of a password manager. End of story. I also see this pattern used on banking websites for inputs like an account number. This drives me crazy as well for the same reason. The computer can get it right mor…

>> 1.) typing it out manually while you can't see if you made a mistake

This is my pet peeve. Password fields should not be obfuscated by default. It should be a toggle that is off on page load. Shoulder surfing is a corner case.

Re: Let them paste passwords

#107

Post by arunc »

All I can say is use keepass. Just remember one crazy long master password for the database and change it regularly. Or use a combination of password and key file.

> Justification 2: 'Pasting passwords makes them easier to forget, because you have fewer chances to practise them'.

Difficult to remember and easy to forget passwords will be auto generated. In fact I encountered few websites that didn't accept long passwords.

> Justification 3: 'Passwords would hang around in the clipboard'

Only for 12 seconds after which keepass will clear the clipboard.

Re: Let them paste passwords

#108

Post by zeveb »

pixeloution wrote: post #75
mrob wrote: post #29

Earlier quoted context omitted.

>if you can remember your password, its probably too weak As XKCD famously pointed out[0], Diceware[1]-style pass phrases can be both secure and memorable. XKCD's four word example isn't secure when fast brute-force attacks are feasible, but eight words is still easily memorable and secure enough for anything. The important point here is that "random words" really does mean "random", i.e. not picked by a human. [0] h…

Just to add to the above comment, a diceware passphrase is MUCH harder to break than most people realize. For example, compare the possible number of combinations: Diceware, 6 words 2.2 x 10^23 Diceware, 5 words 2.8 x 10^19 Diceware, 4 words 3.6 x 10^15 a-zA-Z0-9, symbols, 10 4.3 x 10^19 a-zA-Z0-9, 10char 8.4 x 10^17 a-zA-Z0-9, 8char 2.2 x 10^15 A 6 word diceware phrase has 100 million more combinations than the 8 ch…

You might wish to consider these in terms of entropy, which is typically given in bits:

    Diceware, 6 words          77 bits
    Diceware, 5 words          64 bits
    Diceware, 4 words          51 bits
    a-zA-Z0-9, symbols, 10     65 bits
    a-zA-Z0-9, 10char          59 bits
    a-zA-Z0-9, 8char           50 bits
For any remote site, I recommend using 22 characters from [a-zA-Z0-9]; this is 128 bits, and is easily copy-pasteable.

It's highly amusing when a site tells me that such a password is insufficiently complex, given that it will never in the lifetime of the universe be guessed.

Re: Let them paste passwords

#109

Post by xroche »

tclancy wrote: post #70
thesuitonym wrote: post #58

Earlier quoted context omitted.

Other signs that a site was built by incompetent developers (Or had too much management interference--Devs aren't always to blame!): Only works with Internet Explorer Doesn't work with Internet Explorer Password must have one of 4-10 special characters, but not other special characters. (e.g.: Must contain !, @, ^, &, or parentheses, but not ;, ", etc) Passwords have no requirements Right-click is disabled Video play…

Not allowing + in an email field is one of my pet peeves. Congrats on finding an amazing-looking regex for email validation instead of thinking about it.

Allowing + in an email/password field, but failing to properly encode/decode it, is even more infuriating.

Re: Let them paste passwords

#110

Post by marksomnian »

Pxtl wrote: post #92
tclancy wrote: post #70

Earlier quoted context omitted.

Not allowing + in an email field is one of my pet peeves. Congrats on finding an amazing-looking regex for email validation instead of thinking about it.

Yup. The most email validation I evern implement is "there must be an @ sign with stuff before and after the @ sign". Maybe require a dot in the latter space.

.+@.+\..+
Post reply on HN