Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Don't fuck with paste

github.com

Post reply on HN
Print view View original

291–300 of 397 posts

Re: Don't fuck with paste

#291

Post by 8338550bff96 »

pinkmuffinere wrote: post #72
dylan604 wrote: post #67

Earlier quoted context omitted.

why is all of the sudden ctrl-s wrong by the browser?? you make no sense here. you've never needed to save a web page? i guess i'm showing my age, while i don't use it daily, it has been a valuable feature for many reasons before. Edit: >Then the vast majority of users are wrong. I strongly disagree, and people unwilling to be flexible ruins the experience as those people tend to be the minority

You’re absolutely correct though, the parent comment seems to think there are absolute right and wrong answers for UI. I think that’s just not true, a good UI is one that works for your customers.

Hey, man. I'm just dispensing justice. I don't make the rules

Re: Don't fuck with paste

#292

Post by IgorPartola »

vidarh wrote: post #152
BLKNSLVR wrote: post #143

Earlier quoted context omitted.

You must have had your shit pretty tight for the pen-tester to have to scrape that from the bottom of the barrel.

Sometimes they will just be excessive because nobody applies any kind of critical thinking and/or because they favour looking like they find a lot over any kind of precision. I once had a site where they insisted on disabling ping responses for the website, citing it as a serious security concern. Because surely nobody would otherwise know that the very public website was there. I replied with listing a number of web…

I mean at that point isn’t the pushback “hey Management, this pentester is clearly incompetent. We need a new one.”?

Re: Don't fuck with paste

#293

Post by zettabomb »

vault wrote: post #197

Anyone one else noticed OP got 399 upvotes for sharing a fork with no significant upgrades compared to the original repo?

The fork is for supporting Firefox, which I consider to be a significant upgrade as I don't use Chrome in the first place. You can see the original repo easily, but it's far more annoying with GitHub to find a particular fork. I can keep it to myself next time if it offends you that much though, no reason to tell other people on HN about something I found interesting.

Re: Don't fuck with paste

#294

Post by bsuvc »

globular-toast wrote: post #187
koenraad wrote: post #182

By disabling user input the application security actually gets worse. Users that can’t copy e.g. passwords will use less complex passwords to overcome the trouble of typing in their initially good passwords. But also user experience is degrading when applications enforce complex input and users generate that input like a chad as they should. But now they cannot paste…

I'll add to that systems that require particular characters to be used, like "must use capital, number and special character". I prefer to generate longer passwords but using only regular characters because I find it easier to type on the occasions I do have to do that. Even worse, there are some that restrict what kind of special character you can use. So even when I've generated one I still have to edit to remove o…

Requiring special characters is just another type of security theatre.

Re: Don't fuck with paste

#295

Post by vbezhenar »

indigo945 wrote: post #244
Y-bar wrote: post #234

Earlier quoted context omitted.

Even Apple was so annoyed at this themselves that they actually went for a full open-source open-for-contributions GitHub repository at https://github.com/apple/password-manager-resources to get around these issues. > Many password managers generate strong, unique passwords for people so that they aren't tempted to create their passwords by hand, which leads to easily guessed and reused passwords. Every time a passwo…

Ironically, apple.com itself is listed in this repository! Apparently they don't allow non-ASCII characters in passwords.

This is a good thing. I won't accidentally make weird password without realizing it.

Re: Don't fuck with paste

#296

Post by kbolino »

Sammi wrote: post #266
atoav wrote: post #239

Earlier quoted context omitted.

For my own applications I typically require only three rules to be kept, two of which most users will never even encounter, the password must: 1. be long enough (e.g. 8 characters or more) 2. not be in the list of 10k most used passwords 3. not simply reuse words present in the username, email, birthday (if my application knows about it) This keeps it open and only interferes with truly stupid (aka insecure) password…

Good, except min 8 chars is not safe at all. Don't approach any semblance of security before min 12 chars. Min 14 is when you get into real security. The increase in entropy is exponential with password length, so security increases quickly after this.

The entropy doesn't increase exponentially if my password is just N copies of the same character or phrase, it only increases linearly.

Minimal password requirements allow people who know what they're doing to do the right thing. If you want to stop people who don't know what they're doing from doing the wrong thing, it will take a lot more than just length restrictions.

Re: Don't fuck with paste

#297

Post by Kalium »

cnity wrote: post #229
Nifty3929 wrote: post #135

Earlier quoted context omitted.

"management gave us no choice" - Would you have done differently? "The only way we could show clients a passing pentest..."

Push back on the pentest firm and explain reasoning, rather than bubbling pointless requirements to the engineers.

That might work if your company hired the pen testers, it's a lot less likely to work if they were hired by a client. In the latter case, the overhead of all the required explanation and smoothing of ruffled feathers for the client likely costs a lot more than implementing the stupid timeout in the first place.

Pen testers are often very resistant to pushback. They get it a lot, and usually on things that are real concerns.

Re: Don't fuck with paste

#298

Post by bakugo »

foofie wrote: post #153
Nifty3929 wrote: post #133

Earlier quoted context omitted.

This is a bit cynical isn't it, when the author is clearly being as transparent as possible about what they need and why, which is due to factors outside their control. Of course you're right in a technical sense. They could do whatever they want later. But still let's celebrate and attitude like this rather than criticizing it.

> This is a bit cynical isn't it (...) No, it's called security. Let's put it this way: there have been FLOSS projects whose maintainers intentionally pushed compromised code to unsuspecting end users. See for example the colors attack. What leads you to believe that good intentions are enough?

> Let's put it this way: there have been FLOSS projects whose maintainers intentionally pushed compromised code to unsuspecting end users. See for example the colors attack.

Following this logic, we should all stop using any and all software for which we haven't personally inspected the full source code for, since this could happen to any of them.

Re: Don't fuck with paste

#299

Post by wanderingstan »

nextlevelwizard wrote: post #156
jessriedel wrote: post #12

> In order to provide the smoothest experience as possible, the extension needs to know when you change active tabs. In order for the extension to know about that event, it needs the tabs permission, which Chrome describes as "can read and change all your data on websites you visit." That description is very scary, and is certainly not what this extension is doing. Being an open-sourced project, you can always read a…

The thing is there is no alternative way to do this. I have written some extensions my self and often you cant do anything without having full read and write access to every page. For example I have an extension that lets you right click an image and rotate it by -90/+90/180 degrees. All I want is for the browser to hit me up when there is a ` ` tag, but that is not an option. Either I have to white list every page s…

As someone working on an extension right now, I can definitely say that you only need the “ActiveTab” permission. With this, the extension only becomes active (and can interact with the page) when the user right-clicks an image and selects the action from the extension.

No need for full read and write permission.

Re: Don't fuck with paste

#300

Post by teeray »

globular-toast wrote: post #187
koenraad wrote: post #182

By disabling user input the application security actually gets worse. Users that can’t copy e.g. passwords will use less complex passwords to overcome the trouble of typing in their initially good passwords. But also user experience is degrading when applications enforce complex input and users generate that input like a chad as they should. But now they cannot paste…

I'll add to that systems that require particular characters to be used, like "must use capital, number and special character". I prefer to generate longer passwords but using only regular characters because I find it easier to type on the occasions I do have to do that. Even worse, there are some that restrict what kind of special character you can use. So even when I've generated one I still have to edit to remove o…

You want to have weird password rules? Fine. Please make some standardized meta tags my password manager can find so it generates perfect passwords every time. Bonus points for a well-known URI facilitating touchless password rotation.
Post reply on HN