Anyone one else noticed OP got 399 upvotes for sharing a fork with no significant upgrades compared to the original repo?
Oh yes, 3 files changed compared to parent and the changes are gitignore and updated URLs to the forked repo.
Don't fuck with paste
211–220 of 397 posts
Re: Don't fuck with paste
#212This is why I build an external password thing that emulates a keyboard. Nothing some stupid braindead "security" implementation can do to prevent that from working. It does TOTP too. I had fun with hooking it up to my phone via BT for proximity unlocking. Part of its secret lives on the phone.
I wouldn't say it very secure since i didn't bother with implement a proper asnc encryption for the bt part. And its still vulnerable to a variety of evil maid attacks. My threat model doesn't involve that to ever matter. It should be practically fully resistant to remote full-take attacks.
Re: Don't fuck with paste
#213> In order to provide the smoothest experience as possible, the extension needs to know when you change active tabs. In order for the extension to know about that event, it needs the tabs permission, which Chrome describes as "can read and change all your data on websites you visit." That description is very scary, and is certainly not what this extension is doing. Being an open-sourced project, you can always read a…
You mean the permissions system is broken and most extensions do suffer from the same issue?
Nah mate, we at Google, (bless them Mozilla crooks giving us control over their extensions), don't care about actual issues, we only update extensions to make money and limit user freedom.
Re: Don't fuck with paste
#214This really irks me to no end with password managers in particular. I like to generate 30 character random passwords and sites that limit input or block paste in the verify field are particularly annoying.
Similar for login and 2FA entry fields. There's no good reason for it.
I've often gone an extra bit to ensure password managers work well. I wish more sites would do the same.
Re: Don't fuck with paste
#215You shouldn't need to trust an addon for this, it's something you should be able to set in the browser. In firefox you can toggle dom.event.clipboardevents.enabled
This used to break google docs copy/paste - haven't tried for a while though, maybe that's fixed
Re: Don't fuck with paste
#216Anyone one else noticed OP got 399 upvotes for sharing a fork with no significant upgrades compared to the original repo?
yep. Quite the WTF
Re: Don't fuck with paste
#217My peeve with copy&paste is that it often fails to copy, not to paste. I sometimes need to copy three times until I succeed a paste. Does anyone see this problem?
Re: Don't fuck with paste
#218Earlier quoted context omitted.
I'll add to that systems that require particular characters to be used, like "must use capital, number and special character". I prefer to generate longer passwords but using only regular characters because I find it easier to type on the occasions I do have to do that. Even worse, there are some that restrict what kind of special character you can use. So even when I've generated one I still have to edit to remove o…
Obligatory: https://xkcd.com/936/ (Those of us who know, already know. I'd like to say that we all know here. But if a reader does not recognize "correct horse battery staple", then you're obliged to click the above link -- you're one of today's lucky 10,000![1]) 1: https://xkcd.com/1053/
I have multiple Google Accounts. One of them, I want to remember the password. The others, eh. I just want to copy paste. Doubly so for practically anything else. I wish they'd just let me copy paste.
I have developed a maybe irrational fear of space in strings such as passwords and paths. It always scares me when people use spaces in either case.
Re: Don't fuck with paste
#219Do we really have to put up with vulgarity even on HN? It's bad enough to see it in the title--cause someone will say that's what the title is--but, as can be seen, it breeds unnecessary vulgarity throughout this thread. To see the irony of it all, I'll get fucking downvoted for fucking complaining about this fucking shit and maybe get really fucked up by getting fucking banned. Do you get my fucking point?
You kiss your mother with that mouth?
Re: Don't fuck with paste
#220Earlier quoted context omitted.
> Even worse, there are some that restrict what kind of special character you can use Even worse , there are some that restrict special characters, but don't tell you which! Now you've got to go trial and error to find out which of the special characters in your password is not acceptable to that precious §("/$& website!
Even worse, when on top of all these they add an arbitrary length requirement: It can't be less than 8 letters OR more than 12. :|
That one irks me too... When I built an auth/rbac app previously I did make Max length configurable and it would display a night if set. I set a hidden hard limit to 1k only to reduce attack surfaces that would only display and error if exceeded.
Default was a min-length of 15 as the only requirement with the default hint of "try using a short sentence"
I also had optional use of zxcvbn and haveibeenpwned checks during new passphrase creation.
I really wanted to open source the application but couldn't get approval to do so.
It was a pretty nice little simple auth application that issued RSA signed JWT to configured applications. It was interested into a few internal apps as well as for clients that didn't have something like azure ad, okta, etc. where we wrote bridge apps for auth.
If I had my configuration doc, I'd probably recreate it exactly, but with a Rust backend with HTMX instead of C#+react.
The date store used SQLite as a KV store, with simple methods for access that allowed an exception later for the values. Also wrote support for PostgreSQL and MS-SQL so they could be used where available.
Spent a lot of time on same defaults, hashing and encryption along with required configuration options for a few clients.
Aside: more devs really need to better understand public/private key generation and usage... Like not using the same keys for different environments.