Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let them paste passwords

ncsc.gov.uk

Post reply on HN
Print view View original

231–240 of 376 posts

Re: Let them paste passwords

#231

Post by zlynx »

macintux wrote: post #126
bradleyjg wrote: post #106

Earlier quoted context omitted.

>> 1.) typing it out manually while you can't see if you made a mistake This is my pet peeve. Password fields should not be obfuscated by default. It should be a toggle that is off on page load. Shoulder surfing is a corner case.

Cameras are everywhere in public spaces, and most people wouldn't notice a password field wasn't obfuscated until they've already started typing. Defaulting to obfuscated seems the only sensible option.

But with a camera I can just see what you typed, with a fairly high accuracy.

Re: Let them paste passwords

#232

Post by WorldMaker »

MichaelGG wrote: post #204
pixeloution wrote: post #75

Earlier quoted context omitted.

Just to add to the above comment, a diceware passphrase is MUCH harder to break than most people realize. For example, compare the possible number of combinations: Diceware, 6 words 2.2 x 10^23 Diceware, 5 words 2.8 x 10^19 Diceware, 4 words 3.6 x 10^15 a-zA-Z0-9, symbols, 10 4.3 x 10^19 a-zA-Z0-9, 10char 8.4 x 10^17 a-zA-Z0-9, 8char 2.2 x 10^15 A 6 word diceware phrase has 100 million more combinations than the 8 ch…

A 6 word phrase is also over 3x as long as an 8char password. The entropy calculations are probably generous. The wordlist isn't as long as it looks, because some of the words are strange and people tend to re-roll if they get something like that. It's probably better to assume there's only 1000-2000 "words" people will safely combine.

The instructions explicitly tell you not to reroll strange words. Look them up or use them as a mnemonic. Or if you don't like the strangeness in the default diceware word-list, find a word-list you like better. (There are several alternatives including fun ideas like using a foreign language word-list and learning the pronunciations and meanings of those words.)

Also, the combinations list assumes that the attacker knows the method/word-list used to generate the password, which may not be foreknowledge the attacker has access to, especially in cases of giant many account password brute forcing attacks.

Re: Let them paste passwords

#233

Post by eridius »

benchaney wrote: post #125
Pxtl wrote: post #92

Earlier quoted context omitted.

Yup. The most email validation I evern implement is "there must be an @ sign with stuff before and after the @ sign". Maybe require a dot in the latter space.

Strictly speaking, the dot in the latter space isn't actually necessary. It needs to be a resolvable domain, but if you bought a TLD you could be "name@tld"

Can you actually attach an MX record to a tld?

Re: Let them paste passwords

#234

Post by freeone3000 »

kevin_thibedeau wrote: post #158
ErrantX wrote: post #82

Earlier quoted context omitted.

It's interesting that a lot of us are assuming that pasting encourages the use of password managers. However; I worry that this is a very BIG assumption. Even in my IT-literate circles password management usage is low. In my non-IT circles it is non-existent, and not because of SPP particularly; I suspect SPP (which I agree is silly) derived from an understanding that allowing an average person to paste passwords mea…

> Even in my IT-literate circles password management usage is low You are forked if your manager is ever compromised. It's only a matter of time until a major breach happens with a popular password manager.

So use a local password manager instead of a cloud-based one.

Re: Let them paste passwords

#235

Post by defined »

If it didn't point crackers to these sites, I would love to call out all the sites that do incredibly misguided things such as:

- Allow you to paste passwords into their smartphone app, but not into their web site being accessed from the same device.

- When entering new passwords, limit the password length but not tell you what the limit is ("password is too long"), so you have to reduce it 1 character at a time and keep trying.

- (Mentioned elsewhere in this post) Limit the special characters to some inexplicable subset like !@#$, so you have to edit your generated random password and replace the non-compliant characters with ones from their subset.

- Limit password lengths to (say) 20 characters, allow you to enter a new 20 character password, but only store the first 19 characters so you get an invalid password error when you subsequently log in! I figured it out because I knew I was pasting the correct password, so I just thought, "Hmm, UI team != DB team..." and tried one less character. Bingo.

This happened to me with an old version of (IIRC) a Bank of America iOS online banking app (I am not concerned about mentioning a name here because it's been fixed since then).

- Limit your password to something really short like 10 alphanumerics.

- Require password entry for (say) iCloud before you can get into your password manager, forcing you either to pull up the password on another device and painstakingly enter by hand a 30 character random string, including many special characters, and not letting you see the password (only the last character, for a second). This is so unpleasant that I am sure many people would just change the password to their dog's name or something.

Re: Let them paste passwords

#236

Post by eridius »

simcop2387 wrote: post #192
hfsktr wrote: post #188

Earlier quoted context omitted.

.+@.+(\..+)? should satisfy you both right? I use the original or a form of usually when I had to check emails.

Fully qualified domains actually end in a . If you're allowing sally@google then you must also allow sally@google. To be valid

No you don't. Email addresses explicitly require any periods in the domain to have at least one (non-period) character after the period. From RFC 5322, the relevant grammar production for the domain looks like

  dot-atom-text   =   1*atext *("." 1*atext)
(where atext is letters, digits, or a set of specific punctuation characters that doesn't include periods).

Re: Let them paste passwords

#237

Post by eridius »

jmkni wrote: post #83
artursapek wrote: post #4

Of course it reduces security. It makes you resort to either 1.) typing it out manually while you can't see if you made a mistake 2.) using developer tools to set the 'value' attribute directly "SPP" discourages use of a password manager. End of story. I also see this pattern used on banking websites for inputs like an account number. This drives me crazy as well for the same reason. The computer can get it right mor…

I use a password manager to generate long, complex passwords for every service I use (as complex as the service will allow). For sites that disable pasting, I have developed quite a skill at copying the password character by character from my PM into the password field. I'm even starting to remember a couple of them. Incredibly frustrating.

I write an Alfred (https://www.alfredapp.com) workflow that sends keystroke events using AppleScript for arbitrary strings, specifically to work around SPP.

The AppleScript in question is very simple, it just looks like

  on alfred_script(q)
      tell application "System Events" to keystroke q
  end alfred_script

Re: Let them paste passwords

#238

Post by MichaelGG »

WorldMaker wrote: post #232
MichaelGG wrote: post #204

Earlier quoted context omitted.

A 6 word phrase is also over 3x as long as an 8char password. The entropy calculations are probably generous. The wordlist isn't as long as it looks, because some of the words are strange and people tend to re-roll if they get something like that. It's probably better to assume there's only 1000-2000 "words" people will safely combine.

The instructions explicitly tell you not to reroll strange words. Look them up or use them as a mnemonic. Or if you don't like the strangeness in the default diceware word-list, find a word-list you like better. (There are several alternatives including fun ideas like using a foreign language word-list and learning the pronunciations and meanings of those words.) Also, the combinations list assumes that the attacker…

If you are OK with such words, why not just record the raw dice numbers? Even better, reroll sixes and sum them to get more bits-per-character.

Re: Let them paste passwords

#239

Post by krallja »

pwg wrote: post #216
jmkni wrote: post #83

Earlier quoted context omitted.

I use a password manager to generate long, complex passwords for every service I use (as complex as the service will allow). For sites that disable pasting, I have developed quite a skill at copying the password character by character from my PM into the password field. I'm even starting to remember a couple of them. Incredibly frustrating.

> For sites that disable pasting, For Firefox, setting the "dom.event.clipboardevents.enabled" about:config option to false prevents clipboard paste events from reaching javascript. No more blocked pasting after you toggle that option, even if the website attempts to do so.

I've seen sites that disable the input whenever the ctrl key is held down.

Re: Let them paste passwords

#240

Post by NoGravitas »

eridius wrote: post #230
tonmoy wrote: post #220

Earlier quoted context omitted.

well, string+{whatever1}@gmail.com mails are redirected to string@gmail.com. So a user can just open account for string@gmail.com and then use that to open thousands of user accounts on the site that allows "+" on the email field. (I used to do this on sites that allowed limited number of free downloads after which you had to pay)

But that's not a feature of email in general. That's a feature of gmail, and a few other email providers that have followed suit. For email in general, foo@bar.com and foo+baz@bar.com are distinct emails that may go to different users.

I wouldn't say "a few other email providers that have followed suit". As far as I know, that's always been a feature of Postfix, and common with Sendmail before that. And qmail offered "-" for the same purpose (as well as providing a facility for filtering/redirecting mail based on -extensions).
Post reply on HN