Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The “Cobra Effect” that is disabling paste on password fields

troyhunt.com

Post reply on HN
Print view View original

371–380 of 450 posts

Re: The “Cobra Effect” that is disabling paste on password fields

#371

Post by Gaelan »

pavel_lishin wrote: post #218
makomk wrote: post #114

Earlier quoted context omitted.

Yes. This is to protect against attackers obtaining your full plaintext password on your end, for example by phishing or installing keyloggers. In practice this is a much bigger security threat in the online banking world than someone doing the same by compromising the bank's systems - even if that were to happen they can easily re-verify your identity and issue you with a new password, and you really shouldn't be us…

I wonder how often people just type out the full password into the address bar or into notepad, and then start counting to find the nth digit.

I hope not the address bar, as that goes to Google (or $searchEngine) for autocomplete.

Re: The “Cobra Effect” that is disabling paste on password fields

#372

Post by minitech »

TeMPOraL wrote: post #295
boulos wrote: post #291

Earlier quoted context omitted.

But how many subsets would you do? With enough of them (and particularly relative to password length) this would leak a lot about your password. For say an 8 character password, do these things ask you to enter more than 4 characters?

On my >10 character passwords (I generally don't use shorter passwords with banking sites, so I don't know how the system behaves for short passwords) they ask for ~11 characters. Of course the login box can, and often ends up, being longer than your actual password, so it doesn't visually reveal the actual character count of your password. In my case they usually end up asking for ~5-7 "real" characters. I presume a…

It's a huge detriment to security. You can break sets of 5-7 characters at a time and combine them instead of having to break the entire password at once.

Re: The “Cobra Effect” that is disabling paste on password fields

#373

Post by ProfChronos »

I recently read that Slack has combined salting and hashing with 2FA after their data breach in March 2015. But if I remember well, whenever you want to connect, you can get a "magic link" with an automatically generated password right in your mailbox and then copy-paste it in the app. Has someone tested if it's bullet proof?

Re: The “Cobra Effect” that is disabling paste on password fields

#374

Post by tyfon »

gravypod wrote: post #335
wool_gather wrote: post #330

Earlier quoted context omitted.

Yes, and not only MITM, but IRL impersonation attacks; Wired published an article about it today: https://www.wired.com/2016/06/hey-stop-using-texts-two-facto... Attackers convinced (either with their official badges or by conning) the targets' cell service providers to change the SIM info associated with the accounts, and thereby intercepted SMS authentication codes.

Yea, using a closed source and poorly vetted protocol for secure operations doesn't really sound like a good idea to me. I hope this gets fixed.

As far as I know they are not relying on "gsm encryption" to be protected but are sending encrypted messages over sms.

Re: The “Cobra Effect” that is disabling paste on password fields

#375

Post by phlo »

ianferrel wrote: post #339
jameshart wrote: post #322

Earlier quoted context omitted.

It seems astonishing to me to attempt to include in your threat model "login must be secure even on a system which has malware on it". If a system is infected with a keylogger, the LAST thing you want to do is allow the client to log in.

How would you prevent a client from logging in from an infected system?

Either you employ some sort of malware detection on your login page. Modern trojans mostly inject stuff into web pages, so things like Trusteer Pinpoint will scan the DOM and report back anomalies. Based on those reports you block the user from logging in or send them to a safe sandbox so they can't do any damage to their accounts.

Alternatively, you can work with your clients' ISPs. Most malware still exhibits visible communication patterns, either by getting in touch with other bots or by contacting command-and-control servers. Once you get ISPs to notice that sort of behaviour, they can sandbox their clients and have them clean up their systems before they reach the Internet (and disclose all of their data).

Re: The “Cobra Effect” that is disabling paste on password fields

#376

Post by russjr08 »

x1798DE wrote: post #8
markcerqueira wrote: post #4

Fortunately, it's not hard to get around this on desktop (for Mac at least) with an applet like Paste Typer. But when I see this on iOS it infuriates me. I use 1Password to generate strong (long) passwords and having to type them out manually is a huge PIA.

On Android, KeePassDroid registers as a keyboard to prevent other apps from retrieving your passwords from the clipboard. Not super familiar with iOS, but it seems like a good practice anyway, independent of its utility in circumventing asinine "no pasting" policies.

On iOS, you can't use any third party keyboards on a password field. It just switches back to the system keyboard.

Re: The “Cobra Effect” that is disabling paste on password fields

#377

Post by Vintila »

joshuakcockrell wrote: post #349
eloisius wrote: post #247

TradeKing went full idiot and disabled entering your password by keyboard completely. They implemented an on-screen keyboard and there's no way to opt out. Their support forum is full of angry customers, people who can't use their screen readers anymore, etc. They argue [1] it's to protect their customers from key loggers. [1]: https://community.tradeking.com/forum/categories/suggestions...

Quote from the CEO's blog[1]: > I agree, it’s a little more inconvenient than before.... but for now we’re asking you to accept a little inconvenience for the sake of greatly enhanced security. This gives people incentive to pick the shortest possible easiest to input password. Definitely not good for "greatly enhanced security". [1] http://community.tradeking.com/members/bigdog/blogs/7546-a-w...

Security at the expense of usability comes at the expense of security.

Shamelessly stolen from SE.

Re: The “Cobra Effect” that is disabling paste on password fields

#378

Post by bby »

banana_giraffe wrote: post #233
simbalion wrote: post #74

It always amazes me that someone is hired to implement strong security and they come up with things like paste-blocking. Or "security questions." Security questions are a social engineers best friend. Unless you're savvy and your answers are all strong passwords themselves, and if they are you're probably using keepass or something like it with 400+ bit passwords and you hate wasting time on security questions too.

I respond with a strong password for all security questions. It created a cute incident recently when I had to verify my account over the phone by telling the phone rep that my favorite pet's name was 'o(c:Y^u=86U@4k', or whatever. I'll give the rep credit, they didn't care the answer made sense, just that it matched their screen.

damn u really f*ing up some commas and going swag

Re: The “Cobra Effect” that is disabling paste on password fields

#379

Post by sundvor »

sundvor wrote: post #214
Tharkun wrote: post #86

Earlier quoted context omitted.

Lastpass is horrible. And IIRC someone posted a proof of concept attack a while back which looked exactly like the LP password dialog but instead stole your credentials.

Which is why one should always 2FA.

Uh, well except the attacker managed to target Lastpass' 2FA...

http://www.tomsguide.com/us/lastpass-phishing-attacks,news-2...

Re: The “Cobra Effect” that is disabling paste on password fields

#380

Post by majewsky »

dtemp wrote: post #250
Tepix wrote: post #212

Earlier quoted context omitted.

Doesn't work with United MileagePlus accounts, they only allow multiple choice answers!

Yep. I believe when I created my account, I picked ones that were definitely not real answers, ie. "What's your favorite sport?" answer "lawn darts".

Any social engineers reading this? :)
Post reply on HN