Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The “Cobra Effect” that is disabling paste on password fields

troyhunt.com

Post reply on HN
Print view View original

271–280 of 450 posts

Re: The “Cobra Effect” that is disabling paste on password fields

#271

Post by thaumasiotes »

There is a piece of terrible, unwarranted analysis in this article:

> But there’s one angle to this that helps explain the madness and it goes back to that earlier PayPal screen grab. This was of the change password page, not the login page. You can easily paste into the login page and in fact you can even paste into the original password field on the change password page, just not the new password field or the other field that confirms it.

> The reason lies in the earlier message I showed from PayPal, in particular this part of the password criteria:

> Use[] 8-20 characters

> Ah, so because you’ve gone and put an arbitrary limit on the length of my password and taken away my ability to create a nice a 50 character random string, you’ve had to kill the paste function because otherwise I’d go around thinking I’ve got a 50 char password but it was actually truncated to 20 due to the maxlength attribute of the password field. Nice one guys, good work there

Having spoken to no one about this, I'm still confident that Troy Hunt is full of crap. The reason to disallow copy-and-pasting into the new password field(s) is obviously the same as the reason you have a confirmation field in the first place: you want to make sure the user hasn't entered the password wrong, inadvertently locking themselves out of their own account. Allowing them to enter their password once and then paste it, typos and all, into the "confirm password" field completely defeats the purpose of having the confirm password field at all.

Re: The “Cobra Effect” that is disabling paste on password fields

#272

Post by natermer »

eli wrote: post #262
eloisius wrote: post #247

TradeKing went full idiot and disabled entering your password by keyboard completely. They implemented an on-screen keyboard and there's no way to opt out. Their support forum is full of angry customers, people who can't use their screen readers anymore, etc. They argue [1] it's to protect their customers from key loggers. [1]: https://community.tradeking.com/forum/categories/suggestions...

HSBC does this too. Even though, duh, any sort of targeted malware could trivially record what you're clicking on.

Which why you run screaming away from these sorts of organizations.

If they are too fucking stupid to implement a password text field correctly just imagine the byzantine nightmares that their infrastructure is. All you are doing is volunteering to be part of the next major security breach.

Re: The “Cobra Effect” that is disabling paste on password fields

#273

Post by PepeGomez »

mng2 wrote: post #59
morgante wrote: post #15

The worst is websites which not only disable pasting but don't even let you type your password in. Instead you have to use their janky on-screen keyboard to fumble your way through login. I got so fed up with TradeKing (which has horrible security practices in general) that I close my account.

HSBC has this really odd system where they only ask for the (e.g.) 1st, 6th, and 7th characters of your password. That implies that they store plaintext or something reversible...

Or the answers are premade when the password is created.

Re: The “Cobra Effect” that is disabling paste on password fields

#274

Post by thaumasiotes »

pwg wrote: post #240
level3 wrote: post #18

Earlier quoted context omitted.

As someone running a user-facing site, you cannot control whether your users use password managers. So what's your solution? Just disregard the segment of your users who don't use password managers? That's a tradeoff that you might not want to make, depending on your business. Also, if you're someone who uses a password manager, does disabling pasting really make you less secure? I assume you're still generating pass…

> Just disregard the segment of your users who don't use password managers? No. But, consider that the segment of your users who don't use password managers is also very likely 100% intersecting with the segment of your users who do not ever attempt to paste a password into a password field. So by blocking paste you have zero effect on the users you wish would improve their password practices, and a 100% negative eff…

> But, consider that the segment of your users who don't use password managers is also very likely 100% intersecting with the segment of your users who do not ever attempt to paste a password into a password field.

I guarantee you are wrong about this. For example, a lot of people receive passwords via email, and then paste them in.

Re: The “Cobra Effect” that is disabling paste on password fields

#275

Post by eli »

natermer wrote: post #272
eli wrote: post #262

Earlier quoted context omitted.

HSBC does this too. Even though, duh, any sort of targeted malware could trivially record what you're clicking on.

Which why you run screaming away from these sorts of organizations. If they are too fucking stupid to implement a password text field correctly just imagine the byzantine nightmares that their infrastructure is. All you are doing is volunteering to be part of the next major security breach.

They also have the silly "Security Image" which is supposed to alert me to a phishing site because I'm supposed to notice its absence. I'm guessing that's been effective roughly never.

Re: The “Cobra Effect” that is disabling paste on password fields

#276

Post by gvurrdon »

eloisius wrote: post #247

TradeKing went full idiot and disabled entering your password by keyboard completely. They implemented an on-screen keyboard and there's no way to opt out. Their support forum is full of angry customers, people who can't use their screen readers anymore, etc. They argue [1] it's to protect their customers from key loggers. [1]: https://community.tradeking.com/forum/categories/suggestions...

Another one that is a great pain are the sites that insist upon asking for three letters from one's password to log in. This is all very well if one has an insecure password, but when I've created a 20-character password containing all the necessary characters then this makes it rather more difficult to enter the required values.

Re: The “Cobra Effect” that is disabling paste on password fields

#277

Post by ghurtado »

gvurrdon wrote: post #276
eloisius wrote: post #247

TradeKing went full idiot and disabled entering your password by keyboard completely. They implemented an on-screen keyboard and there's no way to opt out. Their support forum is full of angry customers, people who can't use their screen readers anymore, etc. They argue [1] it's to protect their customers from key loggers. [1]: https://community.tradeking.com/forum/categories/suggestions...

Another one that is a great pain are the sites that insist upon asking for three letters from one's password to log in. This is all very well if one has an insecure password, but when I've created a 20-character password containing all the necessary characters then this makes it rather more difficult to enter the required values.

> three letters from one's password to log in

Could you explain how this works? I've never ran into this and I'm curious as to what it solves / they claim it solves.

Re: The “Cobra Effect” that is disabling paste on password fields

#280

Post by Veratyr »

eli wrote: post #262
eloisius wrote: post #247

TradeKing went full idiot and disabled entering your password by keyboard completely. They implemented an on-screen keyboard and there's no way to opt out. Their support forum is full of angry customers, people who can't use their screen readers anymore, etc. They argue [1] it's to protect their customers from key loggers. [1]: https://community.tradeking.com/forum/categories/suggestions...

HSBC does this too. Even though, duh, any sort of targeted malware could trivially record what you're clicking on.

I assume this is a different HSBC to HSBC US. In the US, they make you answer a security question and either a OTP from their mobile app or randomized characters from your password (e.g. first, second, fourth and last characters).
Post reply on HN