Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let them paste passwords

ncsc.gov.uk

Post reply on HN
Print view View original

201–210 of 376 posts

Re: Let them paste passwords

#201

Post by ben_jones »

jhasse wrote: post #194
coldpizza wrote: post #97

So the main complaint about SPP is that it screws password managers, but then there's this: > Most password managers erase the clipboard as soon as they have pasted your password into the website, and some avoid the clipboard completely by typing in the password with a 'virtual keyboard' instead. Isn't the latter approach much safer? If so, shouldn't it be the de facto standard since it prevents "clipboard stealing"…

Allowing apps to create virtual keyboards with which they may manipulate all other apps might not be a good idea. That's why it won't work with Wayland for example.

I mean your password manager already has all your passwords. The argument can be made that you can trust the man who already has a knife to your throat.

Re: Let them paste passwords

#202

Post by macintux »

noir_lord wrote: post #172
macintux wrote: post #133

Earlier quoted context omitted.

Or cameras you don't know about.

If I have a camera I don't know about in my home then I have bigger issues than a password field on hacker news no?

If you never leave your home then you have much bigger issues than a password field.

Re: Let them paste passwords

#203

Post by theptip »

discreditable wrote: post #7

On Chrome you can use "Don't Fuck With Paste" to override these bad forms: https://chrome.google.com/webstore/detail/dont-fuck-with-pas...

I was overjoyed by this, and then i saw the permissions: "it can read and change all data on websites you visit".

I _think_ that means it can send all of by passwords offsite, or do plugins need a separate permission to phone home?

https://security.stackexchange.com/questions/15259/worst-cas...

Re: Let them paste passwords

#204

Post by MichaelGG »

pixeloution wrote: post #75
mrob wrote: post #29

Earlier quoted context omitted.

>if you can remember your password, its probably too weak As XKCD famously pointed out[0], Diceware[1]-style pass phrases can be both secure and memorable. XKCD's four word example isn't secure when fast brute-force attacks are feasible, but eight words is still easily memorable and secure enough for anything. The important point here is that "random words" really does mean "random", i.e. not picked by a human. [0] h…

Just to add to the above comment, a diceware passphrase is MUCH harder to break than most people realize. For example, compare the possible number of combinations: Diceware, 6 words 2.2 x 10^23 Diceware, 5 words 2.8 x 10^19 Diceware, 4 words 3.6 x 10^15 a-zA-Z0-9, symbols, 10 4.3 x 10^19 a-zA-Z0-9, 10char 8.4 x 10^17 a-zA-Z0-9, 8char 2.2 x 10^15 A 6 word diceware phrase has 100 million more combinations than the 8 ch…

A 6 word phrase is also over 3x as long as an 8char password.

The entropy calculations are probably generous. The wordlist isn't as long as it looks, because some of the words are strange and people tend to re-roll if they get something like that. It's probably better to assume there's only 1000-2000 "words" people will safely combine.

Re: Let them paste passwords

#205

Post by robk »

joshvm wrote: post #78
thesuitonym wrote: post #58

Earlier quoted context omitted.

Other signs that a site was built by incompetent developers (Or had too much management interference--Devs aren't always to blame!): Only works with Internet Explorer Doesn't work with Internet Explorer Password must have one of 4-10 special characters, but not other special characters. (e.g.: Must contain !, @, ^, &, or parentheses, but not ;, ", etc) Passwords have no requirements Right-click is disabled Video play…

We had a gem at my last university (UCL): you must rotate your password every few months, your password can't be anything like any of the previous ones (i.e. previous ones are stored, and they're not hashed), your password must contain special characters etc. Except.. it can only be 8 characters long. Anything else gets truncated (they explicitly said so). The mind boggles. I have no idea where this limitation comes…

Britain and the Commonwealth feel especially bad with onerous and arbitrary requirements on passwords and such.

Re: Let them paste passwords

#206

Post by eximius »

benchaney wrote: post #125
Pxtl wrote: post #92

Earlier quoted context omitted.

Yup. The most email validation I evern implement is "there must be an @ sign with stuff before and after the @ sign". Maybe require a dot in the latter space.

Strictly speaking, the dot in the latter space isn't actually necessary. It needs to be a resolvable domain, but if you bought a TLD you could be "name@tld"

Wow, that is literally the only reason I would want a TLD

Re: Let them paste passwords

#208

Post by vlunkr »

Pxtl wrote: post #92
tclancy wrote: post #70

Earlier quoted context omitted.

Not allowing + in an email field is one of my pet peeves. Congrats on finding an amazing-looking regex for email validation instead of thinking about it.

Yup. The most email validation I evern implement is "there must be an @ sign with stuff before and after the @ sign". Maybe require a dot in the latter space.

I know lots of developers (myself included) who thought they could write a functional email regex. Eventually you learn that in the end, the way to validate an email address is to send an email.

Re: Let them paste passwords

#209

Post by thesuitonym »

kolinko wrote: post #157
thesuitonym wrote: post #58

Earlier quoted context omitted.

Other signs that a site was built by incompetent developers (Or had too much management interference--Devs aren't always to blame!): Only works with Internet Explorer Doesn't work with Internet Explorer Password must have one of 4-10 special characters, but not other special characters. (e.g.: Must contain !, @, ^, &, or parentheses, but not ;, ", etc) Passwords have no requirements Right-click is disabled Video play…

Doesn't work on IE - depends on a business. I made a saas tool for mac developers. Fixing all the quirks would cost far more than the potential 2% users are worth to me. Slideshows - you mean even embeded Slideshare ones? Why? It's a good tool to explain certain ideas, and easily shareable one. We had our slides embeded on a TC post, and we used them as a significant source of traffic.

>I made a saas tool for mac developers.

There was once a time where this was a workable excuse, but today's browsers are actually pretty good about following standards. If you're doing something that works in some browser, but not all, then you're likely exploiting some weird quirk of that browser.

And of course, not testing if it works in x browser is different than actively stopping your webapp from running if it doesn't detect the right browser/os combination.

Re: Let them paste passwords

#210

Post by thesuitonym »

grovegames wrote: post #128
thesuitonym wrote: post #58

Earlier quoted context omitted.

Other signs that a site was built by incompetent developers (Or had too much management interference--Devs aren't always to blame!): Only works with Internet Explorer Doesn't work with Internet Explorer Password must have one of 4-10 special characters, but not other special characters. (e.g.: Must contain !, @, ^, &, or parentheses, but not ;, ", etc) Passwords have no requirements Right-click is disabled Video play…

Don't blame me for some of those things, blame my clients. I can only suggest so many times that something is bad practice, without getting fired.

Ah yes, I should have also mentioned clients. Can't win 'em all, huh?
Post reply on HN