311–320 of 397 posts
Earlier quoted context omitted.
Ironically, apple.com itself is listed in this repository! Apparently they don't allow non-ASCII characters in passwords.
This is a good thing. I won't accidentally make weird password without realizing it.
But. I have implemented these exact security measures into web applications. I've been handed the requirements and I implemented them. I asked my client why we had to do this, when "everyone" knows that this stuff is terrible user-experience and can backfire spectacularly for security (the same people who would memorize a shitty password and use it everywhere, will now write their expiring, "strong", impossible-to-remember password on a sticky note or save it to a text file or spreadsheet called 'passwords.txt' on their Desktop). The answer is: we have to, for compliance. To pass a security audit. To prove to some major client or insurance company that we have a number of industry-standard measures in place to improve security. Unfortunately, your bank does not care about the 2% of us using password managers. Everyone else is still memorizing passwords, forgetting them, and making jokes about it like it's 2003.
Earlier quoted context omitted.
> Even worse, there are some that restrict what kind of special character you can use Even worse , there are some that restrict special characters, but don't tell you which! Now you've got to go trial and error to find out which of the special characters in your password is not acceptable to that precious §("/$& website!
Even worse are "secure answers." Aka osint. I just have my password manager create passwords for those too.
Providing a list is fine as long as they let the user type their own question if they want to. I cannot trust the security of a single one of their crap questions if I were to answer them honestly. However, if they let me type my own question, I can absolutely guarantee it.
Earlier quoted context omitted.
Even worse, when on top of all these they add an arbitrary length requirement: It can't be less than 8 letters OR more than 12. :|
Several comments mention passwords getting silently truncated by input maxlength. FWIW my extension provides a visible warning when this occurs: https://underpassapp.com/StopTheMadness/
In case of not being able to past I normally right click -> inspect element and in the console write $0.value="value from clipboard". Works almost everywhere. Tampering with paste is kinda is like turning of autofill and the HTML5 standard is pretty clear when it should only be turned of: ".. particularly sensitive (for example the activation code for a nuclear weapon); or that it is a value that will never be reused…
That plainly seems like a mistake in the standard that harms security. What's the reasoning there? That somehow human fingers are less prone to error than password managers? The only thing I can think of is malware changing the value of the clipboard to fool someone into pasting the wrong thing - but if you open that scenario then you've got all kinds of ways malware could mess with a manually typed field too.
I welcome this extension as I, too, hate when sites prevent me from pasting (eg. to confirm my account and routing number, email address, etc). It fucks with my password manager and of course it's annoying when intricate password rules are implemented to counter the use of weak passwords. BUT. Yeah there's always a but. But. I have implemented these exact security measures into web applications. I've been handed the…
Do they?
I don’t remember seeing any compliance requirements you can’t reasonably push back. This is just overzealous compliance consultants meeting a team that doesn’t really care about their users. People never really question anything.
- Force select
- Force copy
- Force paste
- Spoof tab visibility ("Don't make me watch" extension)
- Force right click (Firefox has this)
Earlier quoted context omitted.
Push back on the pentest firm and explain reasoning, rather than bubbling pointless requirements to the engineers.
That might work if your company hired the pen testers, it's a lot less likely to work if they were hired by a client. In the latter case, the overhead of all the required explanation and smoothing of ruffled feathers for the client likely costs a lot more than implementing the stupid timeout in the first place. Pen testers are often very resistant to pushback. They get it a lot, and usually on things that are real co…
Earlier quoted context omitted.
Can you explain what you mean by this more?
Probably because "no automatic updates means bad"? Which might be true in general, but maybe not here. Depends how complex the source is.
(https://chromewebstore.google.com/detail/absolute-enable-rig...)