Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let them paste passwords

ncsc.gov.uk

Post reply on HN
Print view View original

161–170 of 376 posts

Re: Let them paste passwords

#161

Post by dllthomas »

noir_lord wrote: post #21
SurrealSoul wrote: post #16

Assuming you are creating an account, UN: Hello PW: World123 My largest issue is that its extremely possible to fat-finger your UN to be Hellow, and its extremely easy to see and fix that mistake. However since passwords are hidden its hard to see ######## is actually Worls123. Now your new account has essentially a one-time login because you have no idea what your password is. Typing it out again, ensures you catch…

I hate hidden passwords, it's stupid. I'd notice someone shoulder surfing so I'd prefer if they wheren't starred out by default with starring out as an option if I do have people around.

You're always leaking more information than you think...

Re: Let them paste passwords

#162

Post by smelendez »

noir_lord wrote: post #21
SurrealSoul wrote: post #16

Assuming you are creating an account, UN: Hello PW: World123 My largest issue is that its extremely possible to fat-finger your UN to be Hellow, and its extremely easy to see and fix that mistake. However since passwords are hidden its hard to see ######## is actually Worls123. Now your new account has essentially a one-time login because you have no idea what your password is. Typing it out again, ensures you catch…

I hate hidden passwords, it's stupid. I'd notice someone shoulder surfing so I'd prefer if they wheren't starred out by default with starring out as an option if I do have people around.

I agree. I wish there was an easy way to say "disable password hiding (always/for this session/while I'm in my current network configuration)."

I never need passwords hidden in my home. I've been in work environments where I know I'm not doing anything where I'd want passwords hidden. I especially don't want passwords hidden on my phone, where it's easy to make a typo.

Re: Let them paste passwords

#163

Post by nradov »

marksomnian wrote: post #110
Pxtl wrote: post #92

Earlier quoted context omitted.

Yup. The most email validation I evern implement is "there must be an @ sign with stuff before and after the @ sign". Maybe require a dot in the latter space.

.+@.+\..+

That regex is defective. See benchaney's reply above.

Re: Let them paste passwords

#164

Post by amelius »

kolinko wrote: post #159
joshvm wrote: post #78

Earlier quoted context omitted.

We had a gem at my last university (UCL): you must rotate your password every few months, your password can't be anything like any of the previous ones (i.e. previous ones are stored, and they're not hashed), your password must contain special characters etc. Except.. it can only be 8 characters long. Anything else gets truncated (they explicitly said so). The mind boggles. I have no idea where this limitation comes…

Theoretically, using homomorphic encryption you can both store passwords securely and check them for similarity. :)

Comparing the hash values would also work (if done right, hash collisions are extremely rare).

Re: Let them paste passwords

#165

Post by ythn »

thesuitonym wrote: post #58
artursapek wrote: post #4

Of course it reduces security. It makes you resort to either 1.) typing it out manually while you can't see if you made a mistake 2.) using developer tools to set the 'value' attribute directly "SPP" discourages use of a password manager. End of story. I also see this pattern used on banking websites for inputs like an account number. This drives me crazy as well for the same reason. The computer can get it right mor…

Other signs that a site was built by incompetent developers (Or had too much management interference--Devs aren't always to blame!): Only works with Internet Explorer Doesn't work with Internet Explorer Password must have one of 4-10 special characters, but not other special characters. (e.g.: Must contain !, @, ^, &, or parentheses, but not ;, ", etc) Passwords have no requirements Right-click is disabled Video play…

> Doesn't work with Internet Explorer

Some of us just can't be bothered. My web app is tested on Chrome, Firefox, and Edge. If you want to use IE you are on your own and I won't support you unless you give me a million dollars.

Re: Let them paste passwords

#166

Post by probablycarrots »

There is another version of SPP being done by the Wells Fargo Commercial Electronic Office site, and probably others. https://wellsoffice.wellsfargo.com

It does allow you to paste into the login fields, but you cannot submit your login credentials this way because the "Sign On" button is greyed out until you've actually typed in each field. I let my password manager fill the fields, then I manually delete and re-type the last character from each of the 3 fields.

Re: Let them paste passwords

#167

Post by jermaustin1 »

SamBam wrote: post #146
jermaustin1 wrote: post #119

Earlier quoted context omitted.

If you can remember it that means you need to change it! I refuse to look at any of my generated passwords. For the services that wont let me paste in, I have a macro that will type whats on my clipboard. Just a simple auto IT script with a WAIT (so I can make sure I focus on the input box) and SEND. My password manager also clears the clipboard if it is equal to the last password copied after a wile (I've never time…

> If you can remember it that means you need to change it! I refuse to look at any of my generated passwords. I'm trying to understand the reasoning for this. Are you dealing with very sensitive information that you have a real reason to fear the rubber-hose cryptanalysis method?

As a consultant, I have been given access to a lot of passwords for clients. From corporate bank accounts to production servers at government agencies. So they are very sensitive, and when my contract is up, I delete the password folder for that client. I started doing that with clients, then eventually ended up continuing it to my personal passwords as well.

Re: Let them paste passwords

#168

Post by Buge »

stanmancan wrote: post #94
criddell wrote: post #76

Earlier quoted context omitted.

How about case insensitive passwords? That one always bugs me because it suggests that maybe they are storing the password.

Not true, they most likely convert all characters to a certain case before they hash it, so even if you entered PASSworD123 they convert to password123 and then hash. I believe I read that Facebook stores a few commonly mistyped versions of everyone's password. Actual password, typed as if caps lock was on, things like that.

That reduces password entropy and makes the hashes easier to crack.

Re: Let them paste passwords

#169

Post by dkonofalski »

bradleyjg wrote: post #106
artursapek wrote: post #4

Of course it reduces security. It makes you resort to either 1.) typing it out manually while you can't see if you made a mistake 2.) using developer tools to set the 'value' attribute directly "SPP" discourages use of a password manager. End of story. I also see this pattern used on banking websites for inputs like an account number. This drives me crazy as well for the same reason. The computer can get it right mor…

>> 1.) typing it out manually while you can't see if you made a mistake This is my pet peeve. Password fields should not be obfuscated by default. It should be a toggle that is off on page load. Shoulder surfing is a corner case.

No way. The number of reported cases of passwords being stolen simply by physical proximity is enough to make this a sensible default. I agree that there should be an option to show the password as you're typing or, at a minimum, once you're done typing (less secure) but making that the default is unreasonable.

Re: Let them paste passwords

#170

Post by corobo »

noir_lord wrote: post #21
SurrealSoul wrote: post #16

Assuming you are creating an account, UN: Hello PW: World123 My largest issue is that its extremely possible to fat-finger your UN to be Hellow, and its extremely easy to see and fix that mistake. However since passwords are hidden its hard to see ######## is actually Worls123. Now your new account has essentially a one-time login because you have no idea what your password is. Typing it out again, ensures you catch…

I hate hidden passwords, it's stupid. I'd notice someone shoulder surfing so I'd prefer if they wheren't starred out by default with starring out as an option if I do have people around.

There's plugins for most (all?) browsers to not hide password fields
Post reply on HN