Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Don't fuck with paste

github.com

Post reply on HN
Print view View original

331–340 of 397 posts

Re: Don't fuck with paste

#331

Post by j1elo »

Merging the bookmarklet version of the upstream addon this one is forked from [1] and another bookmarklet that has been posted in comments here [2], I got to this:

    javascript:['copy','cut','paste','contextmenu','selectstart'].forEach(e=>document.addEventListener(e,e=>e.stopImmediatePropagation(),true));
Right now I cannot think of any page that inhibits pasting, what is a good candidate to test this out?

[1]: https://github.com/jswanner/DontF-WithPaste?tab=readme-ov-fi...

[2]: https://bookmarkl.ink/ashtonmeuser/6e3869d8e468e016f22a4b4de...

Re: Don't fuck with paste

#332

Post by zamalek »

Mordisquitos wrote: post #313
zamalek wrote: post #245

Earlier quoted context omitted.

Even worse are "secure answers." Aka osint. I just have my password manager create passwords for those too.

Are you referring to 'security questions' where the user must choose from a predetermined list? A predetermined list which is often questions whose answers may be know to close attackers (first school), not applicable to everyone (name of first pet), or anglocentrically blind to worldwide cultural diversity (mother's maiden name). I hate that so much. Providing a list is fine as long as they let the user type their o…

Yeah those. I choose them in order, no matter the subject, and put a password manager passphrase in.

Re: Don't fuck with paste

#333

Post by marcosdumay »

afandian wrote: post #169

Has anyone else noticed that copy / paste on Mac OS / Firefox has become unreliable some time in the last 5 years? I don’t know if it’s Firefox or Mac OS but I’ve started finding it copied the wrong thing or ignored a copy command.

I've had VirtualBox clipboard integration failing, and I've had Firefox refusing to let sites add things into the clipboard by Javascript.

But in my experience, local Crtl-C Ctrl-V is flawless on Linux / used to be X11, now Wayland / KDE / Firefox.

Re: Don't fuck with paste

#334

Post by tiltowait »

_0ffh wrote: post #195
globular-toast wrote: post #187

Earlier quoted context omitted.

I'll add to that systems that require particular characters to be used, like "must use capital, number and special character". I prefer to generate longer passwords but using only regular characters because I find it easier to type on the occasions I do have to do that. Even worse, there are some that restrict what kind of special character you can use. So even when I've generated one I still have to edit to remove o…

> Even worse, there are some that restrict what kind of special character you can use Even worse , there are some that restrict special characters, but don't tell you which! Now you've got to go trial and error to find out which of the special characters in your password is not acceptable to that precious §("/$& website!

The worst I've seen have uncommunicated password length maximums—but don't error when you exceed them. Instead, they just truncate your password, but only on creation. When authenticating, they don't truncate, so your password you just made with a password manager is "wrong".

Spotify did/does this. Made canceling my free trial really tricky, because I needed to log in again to do so.

Re: Don't fuck with paste

#335

Post by fredcy »

oldandboring wrote: post #312

I welcome this extension as I, too, hate when sites prevent me from pasting (eg. to confirm my account and routing number, email address, etc). It fucks with my password manager and of course it's annoying when intricate password rules are implemented to counter the use of weak passwords. BUT. Yeah there's always a but. But. I have implemented these exact security measures into web applications. I've been handed the…

Our PCI-compliance audit dings us for not disabling autocomplete on the login form fields. That's not the same as disabling paste, but heading that direction.

For personal use I just abandon any site that won't let me use my password manager (Bitwarden).

Re: Don't fuck with paste

#336

Post by kalupa »

fredcy wrote: post #335
oldandboring wrote: post #312

I welcome this extension as I, too, hate when sites prevent me from pasting (eg. to confirm my account and routing number, email address, etc). It fucks with my password manager and of course it's annoying when intricate password rules are implemented to counter the use of weak passwords. BUT. Yeah there's always a but. But. I have implemented these exact security measures into web applications. I've been handed the…

Our PCI-compliance audit dings us for not disabling autocomplete on the login form fields. That's not the same as disabling paste, but heading that direction. For personal use I just abandon any site that won't let me use my password manager (Bitwarden).

you just abandon banking websites?

Re: Don't fuck with paste

#337

Post by adolph »

oldandboring wrote: post #312

I welcome this extension as I, too, hate when sites prevent me from pasting (eg. to confirm my account and routing number, email address, etc). It fucks with my password manager and of course it's annoying when intricate password rules are implemented to counter the use of weak passwords. BUT. Yeah there's always a but. But. I have implemented these exact security measures into web applications. I've been handed the…

You know that if paste-blocking countermeasures get too popular then the same sites will just implement virtual keyboards.

But I guess if that is to easy for folks with touchscreens then next will be the virtual mouse to click the virtual keyboard. Maybe add a randomly changing acceleration factor to the mouse to tell human and computer apart.

Re: Don't fuck with paste

#338

Post by atoav »

Sammi wrote: post #266
atoav wrote: post #239

Earlier quoted context omitted.

For my own applications I typically require only three rules to be kept, two of which most users will never even encounter, the password must: 1. be long enough (e.g. 8 characters or more) 2. not be in the list of 10k most used passwords 3. not simply reuse words present in the username, email, birthday (if my application knows about it) This keeps it open and only interferes with truly stupid (aka insecure) password…

Good, except min 8 chars is not safe at all. Don't approach any semblance of security before min 12 chars. Min 14 is when you get into real security. The increase in entropy is exponential with password length, so security increases quickly after this.

That is why I wrote e.g., actual length can be tuned to fit the purpose of the application. If there is really sensitive data or attackers gain privileges that could wreak havoc in the wrong hands I'd probably go with 12. If an attacker would gain next to nothing I'd go with 8 for comfort reasons.

This is in addition to other mechanisms of course, like rate limiting password attempts, fail2ban, salting, peppering, chosing the right hash, proper database separation etc.

The goal should be that only an attacker that has a copy of the database could profit from too short passwords, and only if they get the salt and pepper correct, to avoid rainbow-table-attacks.

Re: Don't fuck with paste

#339

Post by tazu »

tdudhhu wrote: post #274
JonChesterfield wrote: post #260

Earlier quoted context omitted.

Shout out to forms which error out with "Password too long! Must be at most ten characters. All from this subset of ascii". Which seems especially popular with banks.

Sometimes I can understand this because banks work with old software that just has these restrictions. But modern apps: just give us Unicode support. And maybe a limit of 255 characters, but not less.

Noticed the other day BCrypt has a max input size of 72 bytes.

Re: Don't fuck with paste

#340

Post by tazu »

JonChesterfield wrote: post #260
globular-toast wrote: post #187

Earlier quoted context omitted.

I'll add to that systems that require particular characters to be used, like "must use capital, number and special character". I prefer to generate longer passwords but using only regular characters because I find it easier to type on the occasions I do have to do that. Even worse, there are some that restrict what kind of special character you can use. So even when I've generated one I still have to edit to remove o…

Shout out to forms which error out with "Password too long! Must be at most ten characters. All from this subset of ascii". Which seems especially popular with banks.

Ran into this with TikTok "Creator Marketplace" (for buying ads), password limit of 20 characters... $200B company.
Post reply on HN