Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Don't fuck with paste

github.com

Post reply on HN
Print view View original

371–380 of 397 posts

Re: Don't fuck with paste

#371

Post by bobbylarrybobby »

twobitshifter wrote: post #279
dkjaudyeqooe wrote: post #52

To work around this I usually drag and drop text pasted into the URL field or somewhere, on my Mac at least. Can I just say though that disabling paste, apparently in the name of security, is the dumbest shit I have ever encountered, right in front of ultra short timeouts everywhere. If only I could meet the people who make these decisions in person...

Here was a dumb one from me the other day. - I had to use login.gov - My password manager had a saved login for it, I didn’t remember it, but it worked - Then the site asked me for an authenticator app code. I checked my authenticator apps and there was nothing there for login.gov. - There’s a login another way button so I click that and the other way is use the authenticator app! - I click what if I can’t get my cod…

While an attacker being able to use just a password (and no 2fa) to delete someone else’s account is pretty bad, stealing information from their account may well be worse. There is a lot of personal information that I have that I'd rather see destroyed than fall into the wrong hands.

Re: Don't fuck with paste

#372

Post by afandian »

NavinF wrote: post #365
afandian wrote: post #169

Has anyone else noticed that copy / paste on Mac OS / Firefox has become unreliable some time in the last 5 years? I don’t know if it’s Firefox or Mac OS but I’ve started finding it copied the wrong thing or ignored a copy command.

Your keyboard, or more specifically your Cmd key, is failing

On 2 MBPs and 2 USB keyboards? Unlikely.

Re: Don't fuck with paste

#373

Post by 1oooqooq »

jessriedel wrote: post #12

> In order to provide the smoothest experience as possible, the extension needs to know when you change active tabs. In order for the extension to know about that event, it needs the tabs permission, which Chrome describes as "can read and change all your data on websites you visit." That description is very scary, and is certainly not what this extension is doing. Being an open-sourced project, you can always read a…

that argument only matters if you're using it on Firefox

if you're using it under chrome you're already working under the profit making goal of a failing advertising company. how worse do you think it can get?

Re: Don't fuck with paste

#374

Post by amarant »

chtitux wrote: post #256
amarant wrote: post #254

Earlier quoted context omitted.

Jesus holy Apple pie! ASCII only in 2023 seems positivity antique. And this from a supposed tech frontrunner! Wth...

Limiting characters can also be a feature, so users can't use emojis in their password (this is so fun), to realize later they can't login, because they don't know how to input emojis from their desktop computer. Hopefully passwords will be gone soon (at least that's my hope).

You might have half a point about emojis, but that's not what Apple is doing here.

Is there a reason I as a Swede should be limited from using my full native alphabet in my passwords for example?

As an example, you know how people sometimes suggest using a short sentence as a password? Here's a phrase in a local dialect, which means "and in the river there's an island" Å i åa e ä ö

Notice how only 2 of those letters are available in ASCII.

ASCII only is not a feature, and I honestly doubt anyone would try to argue that it is if this was about any company other than Apple. Try to look past the "who" and focus on the "what".

Re: Don't fuck with paste

#375

Post by amarant »

docmars wrote: post #305
Sammi wrote: post #263

Earlier quoted context omitted.

There's only so much user hand holding you can do.

With how ubiquitous Apple is, introducing a small limitation to prevent user error can make a huge difference in reducing support requests.

We all know how great a company Apple is(sigh), but even they make mistakes. Stop defending stupidity just because it's Apple being stupid this time.

Re: Don't fuck with paste

#376

Post by bovine3dom »

SushiHippie wrote: post #367
bovine3dom wrote: post #246

Earlier quoted context omitted.

It works sometimes on GitHub, it's just a bit extra as you said. GitHub is what annoyed me enough to make the feature in the first place. It used to work reliably but they made it worse :(

Ah bummers, but nonetheless thanks for implementing this feature! EDIT: I just took a look at GitHub's source code, and they mentioned a setting to turn off these shortcuts, and it really exists!! Under https://github.com/settings/accessibility one can turn off, all "Character keys" which means shortcuts without a modifier. I've never used them, so I just disabled it, and now forward slash always opens the Firefox se…

I had no idea, thanks for sharing!

Re: Don't fuck with paste

#377

Post by tdudhhu »

tazu wrote: post #339
tdudhhu wrote: post #274

Earlier quoted context omitted.

Sometimes I can understand this because banks work with old software that just has these restrictions. But modern apps: just give us Unicode support. And maybe a limit of 255 characters, but not less.

Noticed the other day BCrypt has a max input size of 72 bytes.

Ah ofcourse. My bad. I was thinking about other restrictions like usernames. For passwords there should not be any.

Re: Don't fuck with paste

#378

Post by 1oooqooq »

alpaca128 wrote: post #188
arp242 wrote: post #95

Earlier quoted context omitted.

The worst is when it breaks web apps in really confusing, weird, and broken ways. Slack, for example. Pasting becomes a complete clusterfuck. Things paste in the wrong location, incompletely, etc. I have no idea how they manage to fuck up "paste in a text box"... Facebook Messenger also broke last time I used it where the tab would start using 100% CPU, but it's been a few years since I last used it, so don't know if…

> I have no idea how they manage to fuck up "paste in a text box"... For over 5 years Enter has been broken in YouTube's comment text fields. It inserts a new line but often won't move the cursor. Last year for a while they changed the text to black in the dark theme and it was impossible to write comments because the text fields simply never showed up.

because they are too good for a text box.

they use a div and fuckton of JavaScript to implement a full rich text editor and then pretend it's a textbox.

Re: Don't fuck with paste

#379

Post by howerj »

usrnm wrote: post #275
Sammi wrote: post #262

Earlier quoted context omitted.

You don't even have to make a single line change to your backend to fix this. You can fix this entirely on the frontend by just applying a digest hash on the password before sending to the backend for proper password hashing. This way you can even support "unlimited" length password.

Yeah, just CRC32 the password on the frontend, should be fine

No, use a cryptographic hash function. If you use a CRC32 you will massively reduce the password space and make it easy to find collisions.

Re: Don't fuck with paste

#380

Post by necovek »

Sammi wrote: post #262
indigo945 wrote: post #244

Earlier quoted context omitted.

Ironically, apple.com itself is listed in this repository! Apparently they don't allow non-ASCII characters in passwords.

You don't even have to make a single line change to your backend to fix this. You can fix this entirely on the frontend by just applying a digest hash on the password before sending to the backend for proper password hashing. This way you can even support "unlimited" length password.

That's a very much backwards incompatible change: password that used to work no longer does.

Sure, just put your 500M users through a forced-password reset.

Theoretically, it might also lead to weaker passwords depending on the hash size (that's how you support unlimited lengths by transforming a larger space into finite one) or any issues with the hashing algorithm uncovered in the future.

One thing to keep in mind is that the hash actually becomes the password, so I can imagine plenty of buggy implementations where a developer does not do what you advise ("proper password hashing"): "hey, it's already hashed, I can just store it as-is".

Post reply on HN