Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The “Cobra Effect” that is disabling paste on password fields

troyhunt.com

Post reply on HN
Print view View original

241–250 of 450 posts

Re: The “Cobra Effect” that is disabling paste on password fields

#241

Post by coredog64 »

wbkang wrote: post #216
megalodon wrote: post #185

Earlier quoted context omitted.

This is what we use here in Sweden as well. The reason it works is that all inhabitants are given a personal identification number upon birth, that consists of our birthday + 4 digits which are loosely based on where we are born and if we are male/female. This number is unique for every person and is used to register to the BankID service (among other things) and ensures that it is connected to a single individual.

South Korea has exactly that kind of ID and it is causing a major privacy headache in the country because the number itself tells so much about you. https://en.m.wikipedia.org/wiki/Resident_registration_number

US SSNs used to be that way. The initial prefix was based on where you applied, and the last four were shown like it was nothing (Boeing used my last 4 as part of my UNIX account ID). Instead of 5-9 digits of entropy, you're down to just 2.

Re: The “Cobra Effect” that is disabling paste on password fields

#242

Post by jameshart »

bbarn wrote: post #181
matt_morgan wrote: post #153

Is there a way to disable just pieces of JS, so I can turn off "onpaste"? note: sorry, accidentally deleted earlier version of this comment.

I just added it to my list of stuff that pushing this bookmarklet button fixes: javascript:void(document.onmousedown=null);void(document.onclick=null);void(document.oncontextmenu=null);void(document.onpaste=null)

Off topic note, but this comment causes this page to be nearly unreadable on iPhone, because it doesn't line wrap. Should probably be something in the HN CSS to fix that.

Re: The “Cobra Effect” that is disabling paste on password fields

#243

Post by bbotond »

Tepix wrote: post #212
bbotond wrote: post #200

Earlier quoted context omitted.

Man I hate those security questions with a passion. They are super weakly protected backdoors into your account. Here's how I deal with sites that require them: site: "What is your first teacher's name?" me: "'Fx| The answer is a password equivalent, so I just treat it like a password.

Doesn't work with United MileagePlus accounts, they only allow multiple choice answers!

That's just appalling.

Re: The “Cobra Effect” that is disabling paste on password fields

#244

Post by wila »

Luc wrote: post #142
jorams wrote: post #141

Earlier quoted context omitted.

> You get a pocket-calculator-like device where you need to insert your card (chip and pin type), then you enter your personal code, and then you do a challenge-response thing where you enter a code generated from the website into the device, and it responds with a number you have to type into the website. Such a thing is rather common in The Netherlands, though it's often not a second factor but just the way you log…

> though it's often not a second factor but just the way you log in to online banking. That's still 2FA though, isn't it? You're proving to the server that you have the card and the pin.

The Rabobank system when used for online shopping using the "rabo scanner" works by redirecting to their site. Then displays a color QR code that your scanner reads.

You insert card and enter PIN, then scan the QR code.

The device actually displays amount+account that you are transferring money to. Then asks you if that is correct.

If you enter "yes", it will give you a 8 digit code that you can enter in the website to confirm.

[0] https://www.rabobank.nl/images/how_does_the_rabo_scanner_wor...

[1] https://www.youtube.com/watch?v=f5FIxRsqFUA (work flow - in dutch, start at 20 sec, before that they show the old reader)

Re: The “Cobra Effect” that is disabling paste on password fields

#245

Post by hueving »

SloopJon wrote: post #223
mtmail wrote: post #210

Earlier quoted context omitted.

"The Social Security Administration does not reuse Social Security numbers" https://en.wikipedia.org/wiki/Social_Security_number#Exhaust...

Not quite the same thing, but ID Analytics claimed that "6.1 percent of Americans have at least two SSNs associated with their name," and "more than 15 percent of SSNs are associated with two or more people" in commercial records.

That just means the commercial records are screwed up.

Re: The “Cobra Effect” that is disabling paste on password fields

#246

Post by scurvy »

morgante wrote: post #15

The worst is websites which not only disable pasting but don't even let you type your password in. Instead you have to use their janky on-screen keyboard to fumble your way through login. I got so fed up with TradeKing (which has horrible security practices in general) that I close my account.

TreasuryDirect formerly had this and it drove me nuts. That and the crazy drogan's decoder ring they forced you to use.

Re: The “Cobra Effect” that is disabling paste on password fields

#247

Post by eloisius »

TradeKing went full idiot and disabled entering your password by keyboard completely. They implemented an on-screen keyboard and there's no way to opt out.

Their support forum is full of angry customers, people who can't use their screen readers anymore, etc. They argue [1] it's to protect their customers from key loggers.

[1]: https://community.tradeking.com/forum/categories/suggestions...

Re: The “Cobra Effect” that is disabling paste on password fields

#248

Post by christianmann »

pavel_lishin wrote: post #218
makomk wrote: post #114

Earlier quoted context omitted.

Yes. This is to protect against attackers obtaining your full plaintext password on your end, for example by phishing or installing keyloggers. In practice this is a much bigger security threat in the online banking world than someone doing the same by compromising the bank's systems - even if that were to happen they can easily re-verify your identity and issue you with a new password, and you really shouldn't be us…

I wonder how often people just type out the full password into the address bar or into notepad, and then start counting to find the nth digit.

Don't be ridiculous. They probably type it into Microsoft Word.

Re: The “Cobra Effect” that is disabling paste on password fields

#249

Post by christianmann »

Tepix wrote: post #211
simbalion wrote: post #74

It always amazes me that someone is hired to implement strong security and they come up with things like paste-blocking. Or "security questions." Security questions are a social engineers best friend. Unless you're savvy and your answers are all strong passwords themselves, and if they are you're probably using keepass or something like it with 400+ bit passwords and you hate wasting time on security questions too.

United MileagePlus just switched to security questions that only allow multiple choice answers. Some of the questions only have 12 valid answers. Compare that with even a weak password! Unbelievable.

Did you try editing the DOM?

Re: The “Cobra Effect” that is disabling paste on password fields

#250

Post by dtemp »

Tepix wrote: post #212
bbotond wrote: post #200

Earlier quoted context omitted.

Man I hate those security questions with a passion. They are super weakly protected backdoors into your account. Here's how I deal with sites that require them: site: "What is your first teacher's name?" me: "'Fx| The answer is a password equivalent, so I just treat it like a password.

Doesn't work with United MileagePlus accounts, they only allow multiple choice answers!

Yep. I believe when I created my account, I picked ones that were definitely not real answers, ie. "What's your favorite sport?" answer "lawn darts".
Post reply on HN