Somewhere on this site is a developer who thinks this is a good idea. Or whose boss thinks this is a good idea.
I'd love to hear a defense of this practice.
Don't fuck with paste
321–330 of 397 posts
Re: Don't fuck with paste
#322By disabling user input the application security actually gets worse. Users that can’t copy e.g. passwords will use less complex passwords to overcome the trouble of typing in their initially good passwords. But also user experience is degrading when applications enforce complex input and users generate that input like a chad as they should. But now they cannot paste…
I generally agree that you should let the user use the facilities they're used to, but if you have a habit of copying and pasting credentials you'll be more vulnerable to phishing.
Firefox and Chrome's built-in password management tools would never accidentally enter your credentials on a lookalike site, but you very well might.
Re: Don't fuck with paste
#323By disabling user input the application security actually gets worse. Users that can’t copy e.g. passwords will use less complex passwords to overcome the trouble of typing in their initially good passwords. But also user experience is degrading when applications enforce complex input and users generate that input like a chad as they should. But now they cannot paste…
I generally agree that you should let the user use the facilities they're used to, but if you have a habit of copying and pasting credentials you'll be more vulnerable to phishing. Firefox and Chrome's built-in password management tools would never accidentally enter your credentials on a lookalike site, but you very well might.
And both of those built-in password management tools are actively targeted by credential harvesting malware.
Re: Don't fuck with paste
#324Earlier quoted context omitted.
Several comments mention passwords getting silently truncated by input maxlength. FWIW my extension provides a visible warning when this occurs: https://underpassapp.com/StopTheMadness/
Proprietary, mac only, app store-ware. More madness.
> mac only
Also iOS.
Re: Don't fuck with paste
#325Earlier quoted context omitted.
Sometimes they will just be excessive because nobody applies any kind of critical thinking and/or because they favour looking like they find a lot over any kind of precision. I once had a site where they insisted on disabling ping responses for the website, citing it as a serious security concern. Because surely nobody would otherwise know that the very public website was there. I replied with listing a number of web…
I mean at that point isn’t the pushback “hey Management, this pentester is clearly incompetent. We need a new one.”?
Yes, but with the problem that the pentester had been hired by our client and our client was a multibillion budget quasi-governmental organisation (transit authority) that was not inclined to listen because that'd involve mid-level managers sticking their necks out when they didn't need to and didn't know who was right.
So we did the British thing and went for a lot of passive-aggressive "oh, but how come it's ok for the CIA and your own website?" etc. to force them on the defensive and demonstrate that a lot of what they did was basically ticking pointless boxes.
We did manage to carve out some willingness in the client organisation to ignore bits and pieces as we clearly increased our credibility relative to the pen testers, but it was a massive pain.
Re: Don't fuck with paste
#326Earlier quoted context omitted.
Ironically, apple.com itself is listed in this repository! Apparently they don't allow non-ASCII characters in passwords.
Jesus holy Apple pie! ASCII only in 2023 seems positivity antique. And this from a supposed tech frontrunner! Wth...
In what platforms is it not possible to input 7-bit ASCII characters 020 -- 073 (octal)?
In what platforms is it not possible to input various Unicode or emoji characters, whether at all or reliably?
Re: Don't fuck with paste
#327By disabling user input the application security actually gets worse. Users that can’t copy e.g. passwords will use less complex passwords to overcome the trouble of typing in their initially good passwords. But also user experience is degrading when applications enforce complex input and users generate that input like a chad as they should. But now they cannot paste…
I generally agree that you should let the user use the facilities they're used to, but if you have a habit of copying and pasting credentials you'll be more vulnerable to phishing. Firefox and Chrome's built-in password management tools would never accidentally enter your credentials on a lookalike site, but you very well might.
> I generally agree that you should let the user use the facilities they're used to, but if you have a habit of copying and pasting credentials you'll be more vulnerable to phishing
This is like advising that glass sidelights be installed next to the vault door.
Re: Don't fuck with paste
#328Earlier quoted context omitted.
That plainly seems like a mistake in the standard that harms security. What's the reasoning there? That somehow human fingers are less prone to error than password managers? The only thing I can think of is malware changing the value of the clipboard to fool someone into pasting the wrong thing - but if you open that scenario then you've got all kinds of ways malware could mess with a manually typed field too.
I see I was missing an f in off. The standard says unless it's an interface on a WMD or similar let the browser autofill. The part of one time passwords that might have been indeed obsoleted by 2FA. On the other hand we might still want a single user interaction there even if it's just confirming the full value instead of typing in the 6 digits - much like passkey is doing it.
[deleted]
Re: Don't fuck with paste
#329By disabling user input the application security actually gets worse. Users that can’t copy e.g. passwords will use less complex passwords to overcome the trouble of typing in their initially good passwords. But also user experience is degrading when applications enforce complex input and users generate that input like a chad as they should. But now they cannot paste…
I generally agree that you should let the user use the facilities they're used to, but if you have a habit of copying and pasting credentials you'll be more vulnerable to phishing. Firefox and Chrome's built-in password management tools would never accidentally enter your credentials on a lookalike site, but you very well might.
That's all great, but then there are the times when they don't offer to copy the credentials where they should. Maybe the "correct" URL was too narrowly defined to be useful, or was taken from the setup context and is otherwise wrong for regular usage.... maybe the site changed their authentication process... etc. In the end, all of this tends to defeat the very resistance to the manual entry impulse you describe. If these password manager entry systems worked more flawlessly, your point would carry more weight... but having to defeat the protection your assertion relies upon is commonplace enough in legitimate purposes that it may well be nullified at all times.
In the end, as long as a site is going to use username/password authentication there will always be the need to educate users about what to expect sans the aid of tools.
Re: Don't fuck with paste
#330I welcome this extension as I, too, hate when sites prevent me from pasting (eg. to confirm my account and routing number, email address, etc). It fucks with my password manager and of course it's annoying when intricate password rules are implemented to counter the use of weak passwords. BUT. Yeah there's always a but. But. I have implemented these exact security measures into web applications. I've been handed the…
> The answer is: we have to, for compliance. Do they? I don’t remember seeing any compliance requirements you can’t reasonably push back. This is just overzealous compliance consultants meeting a team that doesn’t really care about their users. People never really question anything.
> Do they?
Probably not. In my experience most standards are pretty broadly defined with hardly any technical requirements.
For instance in ISO 27001 it states that you should create awareness in your organisation about information security. A very minimal way is to send a mass email to everyone in the organisation or hang up posters in the office. But I also spoke to someone that was determined that a half day security awareness training was minimally required.