Live data from Hacker News

The “Cobra Effect” that is disabling paste on password fields

troyhunt.com

261–270 of 450 posts

Re: The “Cobra Effect” that is disabling paste on password fields

#261
post #250
post #212

Earlier quoted context omitted.

Doesn't work with United MileagePlus accounts, they only allow multiple choice answers!

Yep. I believe when I created my account, I picked ones that were definitely not real answers, ie. "What's your favorite sport?" answer "lawn darts".

Even if you picked a fake answer, that doesn't stop someone from brute-forcing it, which is made very easy by the limited range of possible options.

Re: The “Cobra Effect” that is disabling paste on password fields

#262

TradeKing went full idiot and disabled entering your password by keyboard completely. They implemented an on-screen keyboard and there's no way to opt out. Their support forum is full of angry customers, people who can't use their screen readers anymore, etc. They argue [1] it's to protect their customers from key loggers. [1]: https://community.tradeking.com/forum/categories/suggestions...

HSBC does this too. Even though, duh, any sort of targeted malware could trivially record what you're clicking on.

Re: The “Cobra Effect” that is disabling paste on password fields

#264
post #181

Earlier quoted context omitted.

I just added it to my list of stuff that pushing this bookmarklet button fixes: javascript:void(document.onmousedown=null);void(document.onclick=null);void(document.oncontextmenu=null);void(document.onpaste=null)

Wouldn't setting `onclick` to null break desired functionality in some sites?

Sure would. You couple just reload the page after logging in though.

Re: The “Cobra Effect” that is disabling paste on password fields

#265
post #5

I always assumed it was for the same reason sites make you enter your email address twice without pasting - to reduce the chance of mistyping. If you only have to enter something once, then you could easily mistype it and then you end up with an account you can't log in to or even recover. But if you have to type it twice, then the chance is greatly reduced, since you'd have to make the exact same typo twice in a row…

People are going to forget their passwords no matter what, so you have to have a system in place for someone not knowing their password. If you have that system in place, it will also work for people who copied a typo in their password.

In addition, the whole point of making someone type their password twice when changing it is because you can't see what you are typing in a password field. You also can't copy what is in a password field, so there is no danger of someone copying the typoed password in the normal case. You are only stopping people from using something like a password manager.

Re: The “Cobra Effect” that is disabling paste on password fields

#266
post #210
post #204

Earlier quoted context omitted.

SSN's in the US are not unique, though they are only used by one person at a time.

"The Social Security Administration does not reuse Social Security numbers" https://en.wikipedia.org/wiki/Social_Security_number#Exhaust...

Each SSN is used by one person. One person may have multiple SSN's over their lifetime.

Re: The “Cobra Effect” that is disabling paste on password fields

#267

TradeKing went full idiot and disabled entering your password by keyboard completely. They implemented an on-screen keyboard and there's no way to opt out. Their support forum is full of angry customers, people who can't use their screen readers anymore, etc. They argue [1] it's to protect their customers from key loggers. [1]: https://community.tradeking.com/forum/categories/suggestions...

Cause key loggers don't track mouse clicks. Lol. Two factor is their best bet.

VIrtual keyboard changes the character location every time it shows so unless u record click for log time or screen record it is difficult

Re: The “Cobra Effect” that is disabling paste on password fields

#268
post #180

Here in Norway, almost all financial and government institutions allow a form of authentication called BankID ( https://www.bankid.no/en/company/ ). I use the mobile variant and it works for all government related stuff like taxes, health, relocation notices and also with all banks both when logging in and paying bills, signing contracts etc. It is a legally binding identification akin to signing a paper. The procedu…

This is what we use here in Sweden as well. The reason it works is that all inhabitants are given a personal identification number upon birth, that consists of our birthday + 4 digits which are loosely based on where we are born and if we are male/female. This number is unique for every person and is used to register to the BankID service (among other things) and ensures that it is connected to a single individual.

> consists of our birthday + 4 digits

What if you have more than 10,000 people who have the same birthday? Let alone people with similar birthplaces/gender/etc. If that's all there is to it it seems like you'd run up against a combinatorical ceiling pretty soon.

Re: The “Cobra Effect” that is disabling paste on password fields

#269
post #180

Here in Norway, almost all financial and government institutions allow a form of authentication called BankID ( https://www.bankid.no/en/company/ ). I use the mobile variant and it works for all government related stuff like taxes, health, relocation notices and also with all banks both when logging in and paying bills, signing contracts etc. It is a legally binding identification akin to signing a paper. The procedu…

> ... you get a popup on the phone (via the gsm network and sim toolkit, not ip) What about customers who are traveling overseas, or live in a different country?

I works for me abroad as well, I think the base protocol is SMS.
Post reply on HN