Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let them paste passwords

ncsc.gov.uk

Post reply on HN
Print view View original

321–330 of 376 posts

Re: Let them paste passwords

#321

Post by amitava82 »

thesuitonym wrote: post #58
artursapek wrote: post #4

Of course it reduces security. It makes you resort to either 1.) typing it out manually while you can't see if you made a mistake 2.) using developer tools to set the 'value' attribute directly "SPP" discourages use of a password manager. End of story. I also see this pattern used on banking websites for inputs like an account number. This drives me crazy as well for the same reason. The computer can get it right mor…

Other signs that a site was built by incompetent developers (Or had too much management interference--Devs aren't always to blame!): Only works with Internet Explorer Doesn't work with Internet Explorer Password must have one of 4-10 special characters, but not other special characters. (e.g.: Must contain !, @, ^, &, or parentheses, but not ;, ", etc) Passwords have no requirements Right-click is disabled Video play…

That sums up every govt and banking site in India.

Re: Let them paste passwords

#322

Post by rk06 »

xelxebar wrote: post #320
thesuitonym wrote: post #58

Earlier quoted context omitted.

Other signs that a site was built by incompetent developers (Or had too much management interference--Devs aren't always to blame!): Only works with Internet Explorer Doesn't work with Internet Explorer Password must have one of 4-10 special characters, but not other special characters. (e.g.: Must contain !, @, ^, &, or parentheses, but not ;, ", etc) Passwords have no requirements Right-click is disabled Video play…

Wait. Why is zero restrictions on passwords a bad thing?

there should be a minimum length.

Or people will use 2-4 character passwords (often the initials of their name etc)

Re: Let them paste passwords

#323

Post by JadeNB »

thewhitetulip wrote: post #311
thesuitonym wrote: post #58

Earlier quoted context omitted.

Other signs that a site was built by incompetent developers (Or had too much management interference--Devs aren't always to blame!): Only works with Internet Explorer Doesn't work with Internet Explorer Password must have one of 4-10 special characters, but not other special characters. (e.g.: Must contain !, @, ^, &, or parentheses, but not ;, ", etc) Passwords have no requirements Right-click is disabled Video play…

So fb and Twitter are either built by incompetent devs or they have too high a mgmt interference? (Since they auto play videos)

> So fb and Twitter are either built by incompetent devs or they have too high a mgmt interference? (Since they auto play videos)

That seems like it's asked with the expectation that the obvious answer is "no", but I believe it's "yes". Well, I have no idea of the quality of their devs, but someone in the decision chain thought that auto-playing videos was a good idea, and he, she, or they were wrong.

Re: Let them paste passwords

#324

Post by JadeNB »

criddell wrote: post #154
stanmancan wrote: post #94

Earlier quoted context omitted.

Not true, they most likely convert all characters to a certain case before they hash it, so even if you entered PASSworD123 they convert to password123 and then hash. I believe I read that Facebook stores a few commonly mistyped versions of everyone's password. Actual password, typed as if caps lock was on, things like that.

That's a good point. I'm pretty sure my bank is storing the password because they also limit it to some (small) number of characters. I'm guessing it's because the web interface is just passing it on to some ancient back-end system.

> I'm pretty sure my bank is storing the password because they also limit it to some (small) number of characters.

I love how it's always the banks with these ridiculous password practices. I'm really glad that it's not some site where the password is protecting important information.

Re: Let them paste passwords

#325

Post by JadeNB »

apostacy wrote: post #250
mderazon wrote: post #247

I don't care much when it happens on a website, because I can bypass that easily, but it's enraging when I see this practice in mobile apps. For example, my bank's app don't let you paste passwords. I have a strong random password which basically means I can't access it from my phone...

Chase.com is one of the worst. The desktop version of the site does all sorts of browser fingerprinting with javascript. It does things like tries opening up websockets to random local ports, and stuff like that. I had to just throw up my hands and do all of my access to chase.com through a sandboxed browser profile, where I could automate logins.

> Chase.com is one of the worst. The desktop version of the site does all sorts of browser fingerprinting with javascript. It does things like tries opening up websockets to random local ports, and stuff like that.

I'm not fond of this, but what does it have to do with passwords? I (reluctantly) use Chase's online banking on the desktop, and it lets me paste passwords.

Re: Let them paste passwords

#326

Post by wapz »

Johnny555 wrote: post #173
Crespyl wrote: post #113

Earlier quoted context omitted.

Though I'm pretty sure I've seen "Your password is too similar to a previous password" before, which suggests some kind of plaintext Levenshtein distance check. "Is the same as" can be fine with a hash, but "Is too similar" is definitely a red flag.

When I've seen that "your password is too similar..." warning, it was with a system that required entering my current password to set a new password, so no need to store a previous version in plaintext. Though another way around it is to apply a set of common transformations to your new password, hash it and see if it matches the previous one. I.e. if your current password is "Password123" and you try to set it to "P…

Aren't passwords hashed on the client side before sending it across the network? That would make your way around not work (unless that's done on the client side also after verifying from the server that it's correct).

Re: Let them paste passwords

#327

Post by alexbeloi »

JauntyHatAngle wrote: post #319
alexbeloi wrote: post #301

Earlier quoted context omitted.

If you want to see incompetence, the California DMV doesn't allow copy/paste AND it asks for not two, not three, but SIX personal security questions. Oh, and if you forget your login/pass/security-answers, don't worry, you can just re-register your account with the same username as before, with all new password, security questions and answers.

>it asks for not two, not three, but SIX personal security questions. As in... every login it wants you to answer all six of your questions? That's barmy.

No, part of the registration, for password recovery

Re: Let them paste passwords

#328

Post by SomeStupidPoint »

memmcgee wrote: post #314
SomeStupidPoint wrote: post #79

Earlier quoted context omitted.

Why the dig at passphrases?

Because they're not actually effective. Most brute forcing is done via dictionary attacks.

"Dictionary attacks" aren't a magic spell. They're a form of brute forcing, as you seem to be aware.

If you're using about 8000 words, randomly chosen, then a 4 word passphrase is about the same as an 8 character random password. (And in fact, for 8k words, it's basically a direct substitution between 2 characters and 1 word.)

For most intents and purposes, 8-10 characters is fine, and 20 characters is enough to use as a cryptographic key. Similarly, 4-5 words is fine for most uses, and 10 words is enough to use as a cryptographic key.

So I'm not sure what you think isn't effective about passphrases -- they're just using a 2^13 sized alphabet instead of a 2^6.5 one, but either is capable of being used to write down a random string of bits.

Re: Let them paste passwords

#329

Post by sengork »

For macOS users, at least, there is another option: select text and drag and drop it from password manager text field to a website input field.

From what I gather this should use IPC between applications, rather than the clipboard itself.

Re: Let them paste passwords

#330

Post by marmshallow »

defined wrote: post #235

If it didn't point crackers to these sites, I would love to call out all the sites that do incredibly misguided things such as: - Allow you to paste passwords into their smartphone app, but not into their web site being accessed from the same device. - When entering new passwords, limit the password length but not tell you what the limit is ("password is too long"), so you have to reduce it 1 character at a time and…

Some of these are actual reasons why I don't use password managers. I'd rather have the convenience of being able to quickly type in a password that I can easily remember than have to worry about which special characters I'm using or manually typing in an insane hash.
Post reply on HN