Anyone one else noticed OP got 399 upvotes for sharing a fork with no significant upgrades compared to the original repo?
Well, this is for firefox, and the other is for Chrome, so maybe that's a significant upgrade?
Don't fuck with paste
221–230 of 397 posts
Re: Don't fuck with paste
#222Earlier quoted context omitted.
I'll add to that systems that require particular characters to be used, like "must use capital, number and special character". I prefer to generate longer passwords but using only regular characters because I find it easier to type on the occasions I do have to do that. Even worse, there are some that restrict what kind of special character you can use. So even when I've generated one I still have to edit to remove o…
Obligatory: https://xkcd.com/936/ (Those of us who know, already know. I'd like to say that we all know here. But if a reader does not recognize "correct horse battery staple", then you're obliged to click the above link -- you're one of today's lucky 10,000![1]) 1: https://xkcd.com/1053/
Yeah, haveibeenpwned is a great resource. More sites really need to integrate this kind of check.
Re: Don't fuck with paste
#223Alternative for linux users, which "types" the thing on clipboard to the window you select:
alias pasteplease='xclip -selection clipboard -out | tr \\n \\r | xdotool selectwindow windowfocus type --clearmodifiers --delay 25 --window %@ --file -'Re: Don't fuck with paste
#224Earlier quoted context omitted.
I wish I could selectively disable only the "paste" events, because it's extremely useful to have "click to copy this value" type of buttons in our various work tools, and I miss the ability to do that every time I try turning off clipboard events to deal with bad actors.
The solution to this is to treat your clipboard as public in the long term. Don't keep sensitive data in it for longer than you need it. KeePass does this and it's great.
Even when your password is erased from the clipboard after 10 seconds, that's enough for any of the tabs open in your browser to steal it.
Re: Don't fuck with paste
#225Earlier quoted context omitted.
Obligatory: https://xkcd.com/936/ (Those of us who know, already know. I'd like to say that we all know here. But if a reader does not recognize "correct horse battery staple", then you're obliged to click the above link -- you're one of today's lucky 10,000![1]) 1: https://xkcd.com/1053/
I have multiple Google Accounts. One of them, I want to remember the password. The others, eh. I just want to copy paste. Doubly so for practically anything else. I wish they'd just let me copy paste. I have developed a maybe irrational fear of space in strings such as passwords and paths. It always scares me when people use spaces in either case.
For passwords I have to actually remember and type in (os login, password mgr evs) I expressly use a short sentence, often with spacing and punctuation. Sometimes an intentionally misspelled word.
Re: Don't fuck with paste
#226Earlier quoted context omitted.
This is a bit cynical isn't it, when the author is clearly being as transparent as possible about what they need and why, which is due to factors outside their control. Of course you're right in a technical sense. They could do whatever they want later. But still let's celebrate and attitude like this rather than criticizing it.
This has been used as an attack vector in the past: spot reasonably popular plugin; make author an offer; inject whatever tracking/other malwate stuff new owners want (typically after a delay). So now we'd have to trust the author to do thorough vetting of a potential buyer and also not sell if vetting is inconclusive. And this against an adversary aiming to cheat their way past vetting. Might be a cynical take, but…
In this case, you can build and self host on Dev mode... It's a pain but doable.
Re: Don't fuck with paste
#227Earlier quoted context omitted.
> Even worse, there are some that restrict what kind of special character you can use Even worse , there are some that restrict special characters, but don't tell you which! Now you've got to go trial and error to find out which of the special characters in your password is not acceptable to that precious §("/$& website!
Even worse, when on top of all these they add an arbitrary length requirement: It can't be less than 8 letters OR more than 12. :|
Don’t worry, all of this is necessary because the passwords are stored in plain text in the database.
Re: Don't fuck with paste
#228Any time im in this situation i just go to the Menu > Edit > Paste. Usually any overrides are preventing CTRL > V
A menu? We have no need for such outdated shit in CURRENT YEAR.
- Sincerely every browser maker since 2010
Re: Don't fuck with paste
#229Earlier quoted context omitted.
> right in front of ultra short timeouts everywhere > If only I could meet the people who make these decisions in person... For what it's worth, I was once forced to implement a half hour auto-logout on a website that could hardly be considered as containing sensitive data because an external pentest firm flagged the lack of a short timeout as an issue. The only way we could show clients a passing pentest was to comp…
"management gave us no choice" - Would you have done differently? "The only way we could show clients a passing pentest..."
Push back on the pentest firm and explain reasoning, rather than bubbling pointless requirements to the engineers.
Re: Don't fuck with paste
#230> In order to provide the smoothest experience as possible, the extension needs to know when you change active tabs. In order for the extension to know about that event, it needs the tabs permission, which Chrome describes as "can read and change all your data on websites you visit." That description is very scary, and is certainly not what this extension is doing. Being an open-sourced project, you can always read a…
The thing is there is no alternative way to do this. I have written some extensions my self and often you cant do anything without having full read and write access to every page. For example I have an extension that lets you right click an image and rotate it by -90/+90/180 degrees. All I want is for the browser to hit me up when there is a ` ` tag, but that is not an option. Either I have to white list every page s…
For the lay person being able to access any image on any page is pretty much the same thing as being able to access all pages.