Good, but bear in mind that the Xorg clipboard is, in many cases, readable by arbitrary applications.
If you can run Wayland, do it. If for no other reason, this.
Let them paste passwords
281–290 of 376 posts
Re: Let them paste passwords
#282Earlier quoted context omitted.
longer passwords don't hash to longer values (within any reasonable variation of order of magnitude in input size). That would defeat the purpose of hashing
But a longer password would require more combinations for similarity than a short password.
Yes, that's the point being made.
Re: Let them paste passwords
#283On Chrome you can use "Don't Fuck With Paste" to override these bad forms: https://chrome.google.com/webstore/detail/dont-fuck-with-pas...
This add-on will be available for Firefox here after it is reviewed by Mozilla: https://addons.mozilla.org/en-US/firefox/addon/don-t-fuck-wi...
Re: Let them paste passwords
#284Earlier quoted context omitted.
So by definition your password manager master key is weak? That's an interesting paradox!
I don't even have the ability to read my password manager's master key, since all passwords are encrypted with different AES keys, which is then encrypted with a private key I have no ability to read (only ask my smartcard to perform RSA on, if I can authenticate to it). hunter2 is the password manager I wrote for this: https://chiselapp.com/user/rkeene/repository/hunter2/
What if you loose your smartcard ?
Re: Let them paste passwords
#285This is an incredibly frustrating thing with the way OS X handles encrypted disk images as well. Needing to share confidential documents with coworkers, we were hoping to store them in an encrypted disk image. (GPG proved way too complex for anyone to adopt) Of course, the standard OS X GUI prevents you from pasting a password when mounting, which of course led to coworkers resorting to short, easy to type, easy to remember (and easy to crack) passwords.
The best solution I found was to mount via the command line but that definitely wasn't an option for any coworker unfamiliar with the terminal.
https://apple.stackexchange.com/questions/42257/how-can-i-mo...
Also while this may be ultra paranoid, I really don't like typing passwords in public places where endless he cameras can record my screen and keystrokes.
Re: Let them paste passwords
#286Earlier quoted context omitted.
We had a gem at my last university (UCL): you must rotate your password every few months, your password can't be anything like any of the previous ones (i.e. previous ones are stored, and they're not hashed), your password must contain special characters etc. Except.. it can only be 8 characters long. Anything else gets truncated (they explicitly said so). The mind boggles. I have no idea where this limitation comes…
> your password can't be anything like any of the previous ones (i.e. they're not stored hashed) That's... not necessarily the case. You can implement that check by only storing hashes of previous passwords, or of patterns derived form them that are also forbidden (e.g. store a bcrypt of every previous password converted to all lowercase and with numbers and symbols removed).
If you really want to annoy me, use soundex[1] as a final normalization step.
Re: Let them paste passwords
#287Earlier quoted context omitted.
You're cherry-picking pretty heavily: there's a lot of cargo-culted password advice but the current push for user-friendlier password management practices and fundamental model changes (e.g. two-factor with U2F) has been lead by security experts who have, for many years, been loudly reminding everyone that usability is a security requirement rather than an inherent conflict.
I think that the problem is just that the people making these decisions are not security experts, but web designers.
Or often managers who are very concerned about doing the right thing but don't have an expert that they know/trust and so rely on their understanding, which is probably based on the horrible finance sites they use.
I once spend several weeks having meetings where people tried to develop a login management process on a whiteboard from first-principles — in the federal government where the right answer was “We'll follow the central security group's required process” – because they didn't have a security consultant but knew security was a Really Big Deal and didn't want anyone to think they weren't thinking about it.
Re: Let them paste passwords
#288May i also say that the 'feature' of not allowing clipboard pasting on the Mac Os X to decrypt a hard drive is one of the most conspicuous interface decisions that I have ever seen
Re: Let them paste passwords
#289This is an incredibly frustrating thing with the way OS X handles encrypted disk images as well. Needing to share confidential documents with coworkers, we were hoping to store them in an encrypted disk image. (GPG proved way too complex for anyone to adopt) Of course, the standard OS X GUI prevents you from pasting a password when mounting, which of course led to coworkers resorting to short, easy to type, easy to r…
Yes!! Ditto on the weirdness of not allowing to paste from the clipboard to decrypt a hard drive on OS X.
It's like it's on purpose to make you save the password on the keychain or to make it more predictable somehow. I think that's either a very bad decision or evidence of NSA/CIA infiltration/influencing of Apple's software
Re: Let them paste passwords
#290This is an incredibly frustrating thing with the way OS X handles encrypted disk images as well. Needing to share confidential documents with coworkers, we were hoping to store them in an encrypted disk image. (GPG proved way too complex for anyone to adopt) Of course, the standard OS X GUI prevents you from pasting a password when mounting, which of course led to coworkers resorting to short, easy to type, easy to r…
[deleted]