Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let them paste passwords

ncsc.gov.uk

Post reply on HN
Print view View original

191–200 of 376 posts

Re: Let them paste passwords

#191

Post by MyNameIsFred »

jwl wrote: post #5

I can see some logic behind number 3 of having your password in the clipboard. It could lead to users pasting their password somewhere else where it was not intended. However, if you have malware on your machine that can read your clipboard, it can also simply read your keystrokes anyway.

I haven't done Windows development for a long time, but I think that this may be an overstatement, at least on that platform.

You need to have cursor focus to receive key events, right?

The clipboard, by contrast, can be continually monitored, while playing completely "by the rules", right?

Re: Let them paste passwords

#192

Post by simcop2387 »

hfsktr wrote: post #188
nradov wrote: post #163

Earlier quoted context omitted.

That regex is defective. See benchaney's reply above.

.+@.+(\..+)? should satisfy you both right? I use the original or a form of usually when I had to check emails.

Fully qualified domains actually end in a . If you're allowing sally@google then you must also allow sally@google. To be valid

Re: Let them paste passwords

#193

Post by egypturnash »

Khol wrote: post #34

As irritating as this is my bank's app which implements its own soft keyboard, so not only can I not paste my (complex) banking password, the password manager doesn't recognise it as an input. Since I can't have the password visible in the password manager on the phone at the same time as the login prompt in the app, this means that I can only use the bank app if I'm 1) next to another device I can get that password…

This sounds like a reason to consider switching to a new bank. Or a credit union.

Re: Let them paste passwords

#194

Post by jhasse »

coldpizza wrote: post #97

So the main complaint about SPP is that it screws password managers, but then there's this: > Most password managers erase the clipboard as soon as they have pasted your password into the website, and some avoid the clipboard completely by typing in the password with a 'virtual keyboard' instead. Isn't the latter approach much safer? If so, shouldn't it be the de facto standard since it prevents "clipboard stealing"…

Allowing apps to create virtual keyboards with which they may manipulate all other apps might not be a good idea. That's why it won't work with Wayland for example.

Re: Let them paste passwords

#195

Post by dredmorbius »

Santosh83 wrote: post #51
bikamonki wrote: post #32

I've pasted my ultra long pwd in the username field and hit enter. It happened more than once on logins where the form is split into two steps (I am talking to you Google). Why do they split the u/p fields into two steps? Does it add security? Better UX?

The first login page allows you to choose from multiple accounts. But yes, this could just as easily have been done through browser auto complete, but doing it this way means Google can track/link your multiple accounts.

Reference on this?

Re: Let them paste passwords

#198

Post by ben_jones »

majewsky wrote: post #62
thebouv wrote: post #49

Earlier quoted context omitted.

Fork the Don't Fuck with paste code and add that feature (or use it as an example to make your "Don't fuck with copy" extension). https://github.com/jswanner/DontFuckWithPaste I hate sites that do that (or prevent right-click as if that somehow secures their code).

I'd actually like an extension along the lines of "This is not Google Docs, for fuck's sake", that just disables all these APIs that are only ever useful with rich apps, but not with content-heavy websites, for example: - copy/paste hijacking - sensor access: microphone, camera, GPS, etc. Maybe even go further and introduce some sort of rate-limiting for - XHR requests - relayout events to save power and data.

Couldn't you just load a JS file before 3rd party scripts and overload those methods? Preferably in a way that won't break the site.

Re: Let them paste passwords

#199

Post by logfromblammo »

dkonofalski wrote: post #179
logfromblammo wrote: post #77

Earlier quoted context omitted.

You just make up a story and use one of the knickknacks you keep near your workstation as a memory trigger. For instance, if I needed a new strong password, I could use, "This#jar#once#held#1111#M&Ms,#but#now#it#is#empty." The only thing I need to remember there is the story of the jar and the padding character I used in place of spaces. If I really had to, I could put "#" on a sticky note under the jar. But of cours…

That's ludicrous. Is your workstation covered in sticky notes and knickknacks? Are you re-using these passwords? Do you have to buy a new knickknack for every new website you visit that requires a password?

One photograph can contain several virtual knickknacks. I usually don't use sticky notes, as I also make a mnemonic to relate the character to the story. For instance, a story about the beach could use '@' as a conch shell, or '*' as a sea star, or '$' as a sand dollar, or '~' for ocean waves.

But everyone has their own tricks for remembering things.

And I certainly don't make the effort for sites that I don't consider to be important. Those as often as not just get reset via e-mail whenever I forget my password.

Post reply on HN