Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let them paste passwords

ncsc.gov.uk

Post reply on HN
Print view View original

41–50 of 376 posts

Re: Let them paste passwords

#41

Post by dfox »

sowbug wrote: post #17

Slightly off-topic: why didn't client-side certificates ever become a thing?

There are two main reasons:

1) In the beginning the whole X.509/PKCS PKI mechanism was seen as something that came out of X.500 and other telco stuff, is centralized, complex and expensive (all of these things are in fact true for the originally envisioned usage) and thus irrelevant for decentralized internet. (for example, the L for "Lightweight" in "LDAP" essentially means that it uses passwords instead of client side certificates)

2) The UX in early SSL capable browsers for client-side certificates was horrible (In Netscape the whole SSL configuration was in completely separate dialog from browser settings, which was incredibly complex. IE uses SSL implementation from windows which is also used for lots of other things and has centralized configuration and also even today creates confusing dialogs when site requests client certificate). It's somewhat ironic that various ActiveX/Java based replacements of this horrible UX are in fact often even more unusable.

Re: Let them paste passwords

#42

Post by xir78 »

Only argument I can think of for preventing it in is maybe it makes it harder for bots in some cases.

The QQ messenger blocks pasting passwords on iOS I suspect for this reason, perhaps there are teams of people guessing passwords and manually typing them in like gold farming.

Re: Let them paste passwords

#43

Post by raesene6 »

sowbug wrote: post #17

Slightly off-topic: why didn't client-side certificates ever become a thing?

painful maintenance - most users don't want to manage certificates and crypto keys especially in a multi-device world. that's likely the main one

If you don't use a hardware module certificates are easily stolen by malware and as revokation is often problematic, stolen certs can be quite bad news.

Re: Let them paste passwords

#44

Post by Cthulhu_ »

matthewbadeau wrote: post #28
ytch wrote: post #19

I also hate websites that force users use virtual keyboard to enter password.

This is supposed to prevent keylogging.. but I think anything with that amount of access to your PC can tap into the browser to read the request before it's sent. So, probably not as good as it sounds.

It would prevent physical keyloggers (small dongles in between keyboard and computer) and possibly even RF keylogging, but yeah, it's a false sense of security.

Re: Let them paste passwords

#46

Post by Santosh83 »

mrob wrote: post #29
dmh2000 wrote: post #8

"Justification 2: 'Pasting passwords makes them easier to forget, because you have fewer chances to practise them'." if you can remember your password, its probably too weak

>if you can remember your password, its probably too weak As XKCD famously pointed out[0], Diceware[1]-style pass phrases can be both secure and memorable. XKCD's four word example isn't secure when fast brute-force attacks are feasible, but eight words is still easily memorable and secure enough for anything. The important point here is that "random words" really does mean "random", i.e. not picked by a human. [0] h…

But how many of these can you remember? I currently use almost fifty different passwords. I can't imagine committing fifty different pass phrases to memory.

Re: Let them paste passwords

#47

Post by 0xfeba »

simias wrote: post #15
dmh2000 wrote: post #8

"Justification 2: 'Pasting passwords makes them easier to forget, because you have fewer chances to practise them'." if you can remember your password, its probably too weak

So by definition your password manager master key is weak? That's an interesting paradox!

My password? Sure it's weak I guess. The keyfile? No.

Re: Let them paste passwords

#48

Post by raesene6 »

I'm very glad to see this advice for the NCSC, they have been taking a good practical stance on many security issues and helping to provide weight to more pragmatic approaches.

I've never actually managed to find out where the idea of websites banning copy/paste came from. Presumably it's been as a result of security audits, but I can't find any security people who would argue that it's a good idea...

Re: Let them paste passwords

#49

Post by thebouv »

sillysaurus3 wrote: post #10
discreditable wrote: post #7

On Chrome you can use "Don't Fuck With Paste" to override these bad forms: https://chrome.google.com/webstore/detail/dont-fuck-with-pas...

I was hoping this would also prevent websites from messing with the input to the clipboard. It's a bit annoying to copy a sentence from a website only to have "Read more on XYZ!" appended to it.

Fork the Don't Fuck with paste code and add that feature (or use it as an example to make your "Don't fuck with copy" extension).

https://github.com/jswanner/DontFuckWithPaste

I hate sites that do that (or prevent right-click as if that somehow secures their code).

Re: Let them paste passwords

#50

Post by morinted »

alanh wrote: post #27
morinted wrote: post #23

Earlier quoted context omitted.

"Probably" being key here. I still memorize all my passwords and the average one is about 30 characters long, with my "more secure" websites going 60+.

Oh, come on. All of them? If you're like me, that’s hundreds. Are you a memorization savant? Are you creating low-quality passwords? Mine are actually long and random (generated NOT by me and NOT four Dr Seuss words)

It wasn't always this way. I had horrible password standards as I'm sure most of us did when we started out on computers.

- If it's a website I couldn't care about, I use a simple password, probably a remnant from growing up.

- If it's a website I'm concerned about but knowingly won't use, I create a random password and clipboard it during initial creation/login, then every time I use the website I reset it (lazy man's password generator)

- If it's a website that I care about, like HN, I have a loose pattern that I follow that includes symbols and numbers (that's the 30ish character I was referencing). Every website is unique.

- Financial accounts have their own set of rules (unless it's stupid and has, say, an 8 character limit)

- My main email accounts get special treatment with an exceptionally long password.

- Use two-factor authentication wherever possible.

And yes, I could replace this with:

- Password manager

- Two-factor authentication

E: grammar.

Post reply on HN