Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The “Cobra Effect” that is disabling paste on password fields

troyhunt.com

Post reply on HN
Print view View original

441–450 of 450 posts

Re: The “Cobra Effect” that is disabling paste on password fields

#441

Post by madmax96 »

eloisius wrote: post #247

TradeKing went full idiot and disabled entering your password by keyboard completely. They implemented an on-screen keyboard and there's no way to opt out. Their support forum is full of angry customers, people who can't use their screen readers anymore, etc. They argue [1] it's to protect their customers from key loggers. [1]: https://community.tradeking.com/forum/categories/suggestions...

This is the most idiotic thing I've ever heard of. Whoever was responsible for this decision this should lose their job.

Re: The “Cobra Effect” that is disabling paste on password fields

#442

Post by Vexs »

okletsgoyayok wrote: post #438
nommm-nommm wrote: post #405

Earlier quoted context omitted.

Not if you want other people to read your email, its going to go right to their spam filter.

Why is this?

A lot of spam filters filter everything that's not a common, or is a very new, tld.

Re: The “Cobra Effect” that is disabling paste on password fields

#443

Post by superuser2 »

okletsgoyayok wrote: post #438
nommm-nommm wrote: post #405

Earlier quoted context omitted.

Not if you want other people to read your email, its going to go right to their spam filter.

Why is this?

Spammers are the ultimate Sybil attackers. Setting up a useful SMTP server as an individual, and creating a new non-blacklisted identity as a spammer, are effectively the same task. The community of legitimate email providers has responded (quite effectively, and without too many false positives) by making this as expensive, difficult, and time-consuming as possible.

Emails from residential modems are not even worth scanning - they are practically guaranteed to be from botnets. Emails from commodity hosting providers are also pretty suspect, because they're very easy for spammers to get their hands on.

If you want your mail delivered, you need to send it from IP addresses that don't have those obvious red flags, don't have a reputation for sending spam any time in the distant past, and also have a long-term positive reputation for sending non-spam email.

In practical terms, you need to be in the professional mail server administration business full-time (be extremely careful to shut down abusive customers/tenants rapidly, never make a mistake that would let an attacker run an SMTP server on your network, etc.) or you need to pay someone who is, and who trusts you to cloak yourself in their reputation and not ruin it.

Re: The “Cobra Effect” that is disabling paste on password fields

#444

Post by spullara »

okletsgoyayok wrote: post #440
jegoodwin3 wrote: post #323

Earlier quoted context omitted.

The companies involved have specified a protocol for communicating your chosen password to them. Namely, the well known "spelling protocol" whereby you repeat your choice, letter by letter, to the other party. They have gone to some pains to enforce that protocol. The article advocates breaking the bank's protocol for your own convenience because you supposedly know more than the other party. In general, in life, thi…

You know, we all -- us individuals -- have our own protocols as well. These don't always align with yours. This may be hard for you to grasp.

I think they were being sarcastic.

Re: The “Cobra Effect” that is disabling paste on password fields

#445

Post by nommm-nommm »

okletsgoyayok wrote: post #438
nommm-nommm wrote: post #405

Earlier quoted context omitted.

Not if you want other people to read your email, its going to go right to their spam filter.

Why is this?

Because 99.99999% of the email coming out of residential IP addresses are spam so they are just blocked.

Re: The “Cobra Effect” that is disabling paste on password fields

#446

Post by simbalion »

Vexs wrote: post #401
banana_giraffe wrote: post #353

Earlier quoted context omitted.

I would have rattled off something like "oh open paren sea cap why colon caret you equals" and so on. Honestly I have no idea if they parsed the sentence, or decided "gibberish from phone equals gibberish on screen .. good enough" They didn't advise me to change my security question, no doubt because the name of my favorite childhood pet isn't likely to change.

Huh, never thought about it, but that's a pretty good argument against random security questions.

Another good argument is: having 5 passwords is not more secure than 1 really strong password.

I also think 2fa is ridiculous for 99% of applications. The widespread adoption we've seen is largely the result of developers trying to solve for user error, which as I stated in a previous comment is a waste of time and can never succeed (unless your goal is to find the flaws in your system).

Re: The “Cobra Effect” that is disabling paste on password fields

#447

Post by rollingincache »

jandrese wrote: post #425
jasonjayr wrote: post #414

Earlier quoted context omitted.

Isn't this what Intel's SGX system is supposed to do? Create a trusted, isolated execution environment, that's certified by Intel (or whomever manages your PC platform) not to mess with your data in malicious ways? IIRC can't it communicate directly to the keyboard,screen and the network? Besides DRM, this is probably the next best killer feature for the system if it's as secure as they claim.

In practice no, it's not useful for this because it has to take over everything . This makes it basically impossible to support for anything complex like a web browser. You end up having to put way too much stuff in the trusted environment. It might have worked way back in the text terminal days when it was slightly realistic for someone to build basically an entire trusted OS to run instead of your normal OS, but to…

HAVEN (DrawBridge/MOAT) demonstrated the possibility of enclosing a stripped down OS within an enclave.

Hoekstra and fellows at Intel have created a PoC secure browser plugin that utilizes an enclave.

Use of middleboxes that are hardened and have iSGX support can be used as a proxy as well to limit exposure.

Re: The “Cobra Effect” that is disabling paste on password fields

#448

Post by rollingincache »

jasonjayr wrote: post #414
ianferrel wrote: post #339

Earlier quoted context omitted.

How would you prevent a client from logging in from an infected system?

Isn't this what Intel's SGX system is supposed to do? Create a trusted, isolated execution environment, that's certified by Intel (or whomever manages your PC platform) not to mess with your data in malicious ways? IIRC can't it communicate directly to the keyboard,screen and the network? Besides DRM, this is probably the next best killer feature for the system if it's as secure as they claim.

iSGX utilizes iME's DAL interface to access to a very limited subset of iME features that explicitly pertain to cryptography (primitives), time and calculations. iSGX is dependent on a skylake processor (due to the MEE[the hardware being iSGX] being attached/combined into the MC) and BIOS/UEFI support for iSGX.

Features such as PAVP via Intel Insider are not accessible in the current implementation (version 2) of Intel Software Guard Extensions. Access to PAVP and other powerful features of iME such as iAMT has been restricted to Intel and Intel Partners (M$, DoD) through obscurity and no available documentation. However, that being said, there are several white papers authored/co-authored by Intel employees who do make use of these immensely powerful features.

iSGX (nor any current technology that is known to the public) is capable of ensuring input CIA properties (without utilizing Intel Insider/PAVP to display a digital keyboard, transmitted via direct bus to NIC/eth.)

Other security technologies, specifically Sanctum does provide different coverage than iSGX but there is no "unified" security technology that is a one-size-fits-all solution.

iSGX's main PoF is poor security implementation by ISV's/enclave writer's. That being said it is better than TrustZone, TXT, XOM, Bastion, Aegis and Phantom in regards to the ratio of return:implementation cost.

edit: additional information

Re: The “Cobra Effect” that is disabling paste on password fields

#449

Post by Tepix »

callalex wrote: post #329
Tepix wrote: post #213

Earlier quoted context omitted.

You should use a dedicated server instead of a VPS if you're concerned about privacy.

Please let this meme die. There are very few people left in the world that truly believe that hypervisors are leaking your pii all the time.

There are many different types of virtualization. Most of them use disk images, meaning someone can read (or even write to) your disk without you noticing.

Some of them are lightweight virtualizations where a priviledged outside user can run processes inside the VM without requiring authorization or without being logged.

How is this a meme that needs to die?

Re: The “Cobra Effect” that is disabling paste on password fields

#450

Post by Tepix »

kuschku wrote: post #325
Tepix wrote: post #213

Earlier quoted context omitted.

You should use a dedicated server instead of a VPS if you're concerned about privacy.

With a dedicated server I’d have more privacy, indeed, but already with a VPS with encrypted data that requires me to decrypt manually by entering a password upon restart via ssh to start the actual email service I gain a lot of privacy.

What type of virtualization is it? OpenVZ?
Post reply on HN