Let them paste passwords • Hacker News Board

Re: Let them paste passwords

#31

Post by namdnay » Thu, May 18, 2017, 1:55 PM UTC

graphitezepp wrote: post #3

tibbon wrote: post #2

As someone who has used password managers and exceedingly long, impossible to remember and cryptic passwords for years; this quite upsets me when sites prevent it

I can't make any sense whatsoever of it. Does ANY scenario exist where this stops unintended access?

The only scenario I can accept paste-blocking is double-field password creation. At least one should refuse paste, just to make sure I haven't copied the wrong string.

Whilst we're on the topic: I hate stupid input fields that don't ignore whitespace and have a maximum number of characters. So you paste the space-separated number (I'm looking at you IBAN), get an exception because of the spaces, go back and remove them, get another exception, and then realise that the number was truncated due to the field length restriction applied on paste. ARGHHHHHH

Re: Let them paste passwords

#32

Post by bikamonki » Thu, May 18, 2017, 1:55 PM UTC

I've pasted my ultra long pwd in the username field and hit enter. It happened more than once on logins where the form is split into two steps (I am talking to you Google). Why do they split the u/p fields into two steps? Does it add security? Better UX?

Re: Let them paste passwords

#33

Post by ytch » Thu, May 18, 2017, 1:57 PM UTC

matthewbadeau wrote: post #28

ytch wrote: post #19

I also hate websites that force users use virtual keyboard to enter password.

This is supposed to prevent keylogging.. but I think anything with that amount of access to your PC can tap into the browser to read the request before it's sent. So, probably not as good as it sounds.

Yes, and it may also screenshoting the pixels around where mouse clicks, so I don't think it can prevent keylooger. OTP is better solution.

Re: Let them paste passwords

#34

Post by Khol » Thu, May 18, 2017, 1:57 PM UTC

As irritating as this is my bank's app which implements its own soft keyboard, so not only can I not paste my (complex) banking password, the password manager doesn't recognise it as an input.

Since I can't have the password visible in the password manager on the phone at the same time as the login prompt in the app, this means that I can only use the bank app if I'm 1) next to another device I can get that password on or 2) if I write the password down on something.

Re: Let them paste passwords

#35

Post by graton » Thu, May 18, 2017, 1:57 PM UTC

I know that Battle.net does this :( I went to change my password and I couldn't paste the new one I had generated. Motivated me to install a simple Greasemonkey script to override that.

Re: Let them paste passwords

#36

Post by Santosh83 » Thu, May 18, 2017, 1:57 PM UTC

sowbug wrote: post #17

Slightly off-topic: why didn't client-side certificates ever become a thing?

Passwords were already almost universal even before ANY encryption, during the early days of the WWW and before that too.

Re: Let them paste passwords

#37

Post by npongratz » Thu, May 18, 2017, 1:57 PM UTC

sowbug wrote: post #17

Slightly off-topic: why didn't client-side certificates ever become a thing?

Some old discussion here: https://news.ycombinator.com/item?id=6732110

Re: Let them paste passwords

#38

Post by maxxxxx » Thu, May 18, 2017, 1:57 PM UTC

This whole discussion is a good example for everything that's wrong with computer security. Instead of coming up with solutions that make it easy for people to follow good practices the "experts" make it even more cumbersome. Most people just want to use the computer and not think about security.

Re: Let them paste passwords

#39

Post by raesene6 » Thu, May 18, 2017, 1:58 PM UTC

alvarosevilla95 wrote: post #13

Please correct me if I'm wrong, as this is all conjecture. I feel passwords used to be thought of as a combination of characters that you keep in your head, and should only leave your head when being entered in a password field. Preventing paste discourages storing your password in a file called passwords.txt, and accidentally pasting it somewhere else as well. Of course, we now understand passwords should have some…

The idea of passwords being something you remembered, died out when we started to see a proliferation of systems needing passwords for authentication.

Humans (in general there are some exceptions) aren't very good at remembering large numbers of arbitrary long random strings.

So using a password safe and then copy/pasting into the relevant dialog is likely to be a better option than relying on human memory (which inevitably means for most people using the same password in many places)

Re: Let them paste passwords

#40

Post by 0xfeba » Thu, May 18, 2017, 2:00 PM UTC

artursapek wrote: post #4

Of course it reduces security. It makes you resort to either 1.) typing it out manually while you can't see if you made a mistake 2.) using developer tools to set the 'value' attribute directly "SPP" discourages use of a password manager. End of story. I also see this pattern used on banking websites for inputs like an account number. This drives me crazy as well for the same reason. The computer can get it right mor…

You can also paste it somewhere on the browser or site, then select and drag it to the password field in a lot of cases.