Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Don't fuck with paste

github.com

Post reply on HN
Print view View original

271–280 of 397 posts

Re: Don't fuck with paste

#271

Post by dwighttk »

globular-toast wrote: post #187
koenraad wrote: post #182

By disabling user input the application security actually gets worse. Users that can’t copy e.g. passwords will use less complex passwords to overcome the trouble of typing in their initially good passwords. But also user experience is degrading when applications enforce complex input and users generate that input like a chad as they should. But now they cannot paste…

I'll add to that systems that require particular characters to be used, like "must use capital, number and special character". I prefer to generate longer passwords but using only regular characters because I find it easier to type on the occasions I do have to do that. Even worse, there are some that restrict what kind of special character you can use. So even when I've generated one I still have to edit to remove o…

Also the rules sometimes show up saying you’ve violated them when you haven’t…

yes it’s longer than 8 characters

Yes I have one of your stupid special characters

Yes I’ve fulfilled all your other written rules

Oh… it also has to be LESS than 21 characters? Why did you not say that?

Re: Don't fuck with paste

#272

Post by dwighttk »

oneeyedpigeon wrote: post #209
piyush_soni wrote: post #206

Earlier quoted context omitted.

Even worse, when on top of all these they add an arbitrary length requirement: It can't be less than 8 letters OR more than 12. :|

"look, just tell me what you want my password to goddam be, and I'll go with that!"

“Sure but you can’t copy it out”

Re: Don't fuck with paste

#273

Post by kdomanski »

JonChesterfield wrote: post #260
globular-toast wrote: post #187

Earlier quoted context omitted.

I'll add to that systems that require particular characters to be used, like "must use capital, number and special character". I prefer to generate longer passwords but using only regular characters because I find it easier to type on the occasions I do have to do that. Even worse, there are some that restrict what kind of special character you can use. So even when I've generated one I still have to edit to remove o…

Shout out to forms which error out with "Password too long! Must be at most ten characters. All from this subset of ascii". Which seems especially popular with banks.

Yeah, banks unfortunately have their opinionated checklists of “best practices”, also know as “what every other bank does”.

Re: Don't fuck with paste

#274

Post by tdudhhu »

JonChesterfield wrote: post #260
globular-toast wrote: post #187

Earlier quoted context omitted.

I'll add to that systems that require particular characters to be used, like "must use capital, number and special character". I prefer to generate longer passwords but using only regular characters because I find it easier to type on the occasions I do have to do that. Even worse, there are some that restrict what kind of special character you can use. So even when I've generated one I still have to edit to remove o…

Shout out to forms which error out with "Password too long! Must be at most ten characters. All from this subset of ascii". Which seems especially popular with banks.

Sometimes I can understand this because banks work with old software that just has these restrictions.

But modern apps: just give us Unicode support. And maybe a limit of 255 characters, but not less.

Re: Don't fuck with paste

#275

Post by usrnm »

Sammi wrote: post #262
indigo945 wrote: post #244

Earlier quoted context omitted.

Ironically, apple.com itself is listed in this repository! Apparently they don't allow non-ASCII characters in passwords.

You don't even have to make a single line change to your backend to fix this. You can fix this entirely on the frontend by just applying a digest hash on the password before sending to the backend for proper password hashing. This way you can even support "unlimited" length password.

Yeah, just CRC32 the password on the frontend, should be fine

Re: Don't fuck with paste

#276

Post by [deleted] »

BLKNSLVR wrote: post #141
dkjaudyeqooe wrote: post #52

To work around this I usually drag and drop text pasted into the URL field or somewhere, on my Mac at least. Can I just say though that disabling paste, apparently in the name of security, is the dumbest shit I have ever encountered, right in front of ultra short timeouts everywhere. If only I could meet the people who make these decisions in person...

Even MS Remote Desktop doesn't allow it. Why do they think password managers exist?

[deleted]

Re: Don't fuck with paste

#277

Post by techvada »

styxfrix wrote: post #93
ryandrake wrote: post #15

Earlier quoted context omitted.

Too much gets justified with vague, handwavey "because security" excuses. We can't do this because... uh... because security, yea, that's it! It should be "Specific vulnerability or GTFO."

Yeah. NordVPN is an example of this handwaviness. They refuse to delete my account to which I can successfully log into and which I've never used because they claim that as "a security-oriented company we do not take account change or deletion requests lightly, hence we request payment information to confirm ownership of the account, as we would not want anyone but the rightful owner making such changes." Problem bei…

[dead]

Re: Don't fuck with paste

#278

Post by user3939382 »

globular-toast wrote: post #187
koenraad wrote: post #182

By disabling user input the application security actually gets worse. Users that can’t copy e.g. passwords will use less complex passwords to overcome the trouble of typing in their initially good passwords. But also user experience is degrading when applications enforce complex input and users generate that input like a chad as they should. But now they cannot paste…

I'll add to that systems that require particular characters to be used, like "must use capital, number and special character". I prefer to generate longer passwords but using only regular characters because I find it easier to type on the occasions I do have to do that. Even worse, there are some that restrict what kind of special character you can use. So even when I've generated one I still have to edit to remove o…

High quality complexity and password policy guidelines are provided by NIST and no one uses them. It’s called NIST 800-63b. Just use it!

Re: Don't fuck with paste

#279

Post by twobitshifter »

dkjaudyeqooe wrote: post #52

To work around this I usually drag and drop text pasted into the URL field or somewhere, on my Mac at least. Can I just say though that disabling paste, apparently in the name of security, is the dumbest shit I have ever encountered, right in front of ultra short timeouts everywhere. If only I could meet the people who make these decisions in person...

Here was a dumb one from me the other day.

- I had to use login.gov

- My password manager had a saved login for it, I didn’t remember it, but it worked

- Then the site asked me for an authenticator app code. I checked my authenticator apps and there was nothing there for login.gov.

- There’s a login another way button so I click that and the other way is use the authenticator app!

- I click what if I can’t get my code?

- It says I must DELETE my account.

- I click to delete my account and it sends me an email.

- The email says to wait 24 hours for another account deletion email.

- 24 hours later I get an email that allows me to delete my account.

What was in the account? I have no idea, but it seems that it must be sensitive for some uses of the login. But if it’s sensitive and important why am I able to delete the account, the most destructive thing? Why is an email enough for me to delete it but not enough for me to get an auth code?

Re: Don't fuck with paste

#280

Post by [deleted] »

Sammi wrote: post #263
chtitux wrote: post #256

Earlier quoted context omitted.

Limiting characters can also be a feature, so users can't use emojis in their password (this is so fun), to realize later they can't login, because they don't know how to input emojis from their desktop computer. Hopefully passwords will be gone soon (at least that's my hope).

There's only so much user hand holding you can do.

[deleted]
Post reply on HN