Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Don't fuck with paste

github.com

Post reply on HN
Print view View original

231–240 of 397 posts

Re: Don't fuck with paste

#231

Post by cdr »

piyush_soni wrote: post #206
_0ffh wrote: post #195

Earlier quoted context omitted.

> Even worse, there are some that restrict what kind of special character you can use Even worse , there are some that restrict special characters, but don't tell you which! Now you've got to go trial and error to find out which of the special characters in your password is not acceptable to that precious §("/$& website!

Even worse, when on top of all these they add an arbitrary length requirement: It can't be less than 8 letters OR more than 12. :|

Even worse, some will simply arbitrarily silently truncate the password. But not everywhere! The sign up page might silently truncate and then the actual login page might not.

Re: Don't fuck with paste

#232

Post by LM358 »

pupppet wrote: post #5

Right up there with hijacking Ctrl-F.

I don't think anyone here can imagine my bewilderment, confusion, and ultimately anger, the day I discovered that in the web interface for Outlook, Ctrl+V is the default shortcut for... send email.

I would very much like to know what went through their heads when they decided on that. On further thought, maybe I don't.

Re: Don't fuck with paste

#233

Post by ggrelet »

tracker1 wrote: post #214

This really irks me to no end with password managers in particular. I like to generate 30 character random passwords and sites that limit input or block paste in the verify field are particularly annoying. Similar for login and 2FA entry fields. There's no good reason for it. I've often gone an extra bit to ensure password managers work well. I wish more sites would do the same.

I find passphrases to be better at tackling this exact scenario (and others). The password is long and secure but easy to type because it’s composed with actual English words.

Re: Don't fuck with paste

#234

Post by Y-bar »

globular-toast wrote: post #187
koenraad wrote: post #182

By disabling user input the application security actually gets worse. Users that can’t copy e.g. passwords will use less complex passwords to overcome the trouble of typing in their initially good passwords. But also user experience is degrading when applications enforce complex input and users generate that input like a chad as they should. But now they cannot paste…

I'll add to that systems that require particular characters to be used, like "must use capital, number and special character". I prefer to generate longer passwords but using only regular characters because I find it easier to type on the occasions I do have to do that. Even worse, there are some that restrict what kind of special character you can use. So even when I've generated one I still have to edit to remove o…

Even Apple was so annoyed at this themselves that they actually went for a full open-source open-for-contributions GitHub repository at https://github.com/apple/password-manager-resources to get around these issues.

> Many password managers generate strong, unique passwords for people so that they aren't tempted to create their passwords by hand, which leads to easily guessed and reused passwords. Every time a password manager generates a password that isn't compatible with a website, a person not only has a bad experience but a reason to be tempted to create their password. Compiling password rule quirks helps fewer people run into issues like these while also documenting that a service's password policy is too restrictive for people using password managers, which may incentivize the services to change.

Re: Don't fuck with paste

#235

Post by stefan_ »

nextlevelwizard wrote: post #156
jessriedel wrote: post #12

> In order to provide the smoothest experience as possible, the extension needs to know when you change active tabs. In order for the extension to know about that event, it needs the tabs permission, which Chrome describes as "can read and change all your data on websites you visit." That description is very scary, and is certainly not what this extension is doing. Being an open-sourced project, you can always read a…

The thing is there is no alternative way to do this. I have written some extensions my self and often you cant do anything without having full read and write access to every page. For example I have an extension that lets you right click an image and rotate it by -90/+90/180 degrees. All I want is for the browser to hit me up when there is a ` ` tag, but that is not an option. Either I have to white list every page s…

I have an extension to replace the "backspace for back" keybind they intentionally broke after 30 or how many years and of course it needs access to everything everywhere, because apparently they can't envision extension functionality that isn't "inject JavaScript".

Re: Don't fuck with paste

#236

Post by anshorei »

piyush_soni wrote: post #206
_0ffh wrote: post #195

Earlier quoted context omitted.

> Even worse, there are some that restrict what kind of special character you can use Even worse , there are some that restrict special characters, but don't tell you which! Now you've got to go trial and error to find out which of the special characters in your password is not acceptable to that precious §("/$& website!

Even worse, when on top of all these they add an arbitrary length requirement: It can't be less than 8 letters OR more than 12. :|

Even worse, when the password has an arbitrary length requirement of 20, but the site doesn't tell you and just cuts of any trailing characters exceeding the requirement during account creation.

You have no idea how long it took me to figure that one out.

Re: Don't fuck with paste

#237

Post by piyush_soni »

cdr wrote: post #231
piyush_soni wrote: post #206

Earlier quoted context omitted.

Even worse, when on top of all these they add an arbitrary length requirement: It can't be less than 8 letters OR more than 12. :|

Even worse, some will simply arbitrarily silently truncate the password. But not everywhere! The sign up page might silently truncate and then the actual login page might not.

Wow. That would be a wonderful game of treasure hunt. Fortunately I've not come across that so far :D

Re: Don't fuck with paste

#238

Post by vsnf »

stefan_ wrote: post #235
nextlevelwizard wrote: post #156

Earlier quoted context omitted.

The thing is there is no alternative way to do this. I have written some extensions my self and often you cant do anything without having full read and write access to every page. For example I have an extension that lets you right click an image and rotate it by -90/+90/180 degrees. All I want is for the browser to hit me up when there is a ` ` tag, but that is not an option. Either I have to white list every page s…

I have an extension to replace the "backspace for back" keybind they intentionally broke after 30 or how many years and of course it needs access to everything everywhere, because apparently they can't envision extension functionality that isn't "inject JavaScript".

On Firefox this is an option in about:config, no need for an extension. I’m on mobile rn so I don’t have an reference to the specific key, but it’s something like “enhanced backspace”

Re: Don't fuck with paste

#239

Post by atoav »

globular-toast wrote: post #187
koenraad wrote: post #182

By disabling user input the application security actually gets worse. Users that can’t copy e.g. passwords will use less complex passwords to overcome the trouble of typing in their initially good passwords. But also user experience is degrading when applications enforce complex input and users generate that input like a chad as they should. But now they cannot paste…

I'll add to that systems that require particular characters to be used, like "must use capital, number and special character". I prefer to generate longer passwords but using only regular characters because I find it easier to type on the occasions I do have to do that. Even worse, there are some that restrict what kind of special character you can use. So even when I've generated one I still have to edit to remove o…

For my own applications I typically require only three rules to be kept, two of which most users will never even encounter, the password must:

1. be long enough (e.g. 8 characters or more)

2. not be in the list of 10k most used passwords

3. not simply reuse words present in the username, email, birthday (if my application knows about it)

This keeps it open and only interferes with truly stupid (aka insecure) password choices.

Additionally I like to propose 8 passphrases to the user so they can choose one of their liking with one click (this also serves as a proposal what a good passphrase could look like).

Re: Don't fuck with paste

#240

Post by SushiHippie »

bovine3dom wrote: post #208
dotancohen wrote: post #148

Earlier quoted context omitted.

The Vimperator/Tridactyl (Firefox VI shortcuts extension) search / is not hijacked on the Stripe API documention.

FWIW, the / search isn't part of Tridactyl but we do inject some code that frees up / from most websites so Firefox can use it. It's possible to write your own user script to do it (you just need to add a keypress event handler that does preventDefault() and maybe stopPropagation()) with no need for Tridactyl :)

But it still doesn't seem to work on GitHub, did you whitelist GitHub for the preventDefault or is GitHub just a bit extra when it comes to hijacking keybinds?
Post reply on HN