Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let them paste passwords (2017)

ncsc.gov.uk

Post reply on HN
Print view View original

51–60 of 129 posts

Re: Let them paste passwords (2017)

#51

Post by pmontra »

godot wrote: post #31

On this point: > write passwords down in places that are easy to find (like post-it notes next to the screen) Writing passwords on post-it notes is often used as a ridicule of non-tech-savvy folks behavior. I'd like to pose this question: If you're doing this not at an office, but at home, is this really so bad? Say you run a web site on AWS and write your really long AWS password on a piece of paper at home. It woul…

I know a person with many sheets of paper filled by site makes and their passwords. Basically a password manager on paper. It's an excellent protection against password stealing malware but it's very bad if a burglar enters the house and also steal the passwords. It's also a pain to look for a site (the passwords are not on an old fashioned phone numbers agenda) and to type the passwords every time.

Re: Let them paste passwords (2017)

#52

Post by nine_k »

tialaramex wrote: post #21
jiggawatts wrote: post #14

Making password entry difficult is like attempting weight loss by eating bland food. It's not the flavour that makes you fat. Nonetheless, there's this perception that something delicious can't be good for a diet. People have this notion that to lose weight, there must be penance . An element of punishing oneself for past transgressions seems essential . Security people have the same mindset. Security must be a hassl…

There was a recent discussion on HN that branches into this idea about the importance of UX. I agree with you, with a twist. What you want is that the happy path for security is zero hassle, but the unhappy paths should also drop dead with zero hassle. This is the UX I really like for WebAuthn / U2F. All the interactions on the happy path are very smooth. Need a second factor, tap, go. Almost frictionless. On my phon…

Another unhappy path is very difficult.

Your phone got stolen or smashed. Your 2FA is just not available. Welcome to the sea of hassle proving your identity.

But a little bit of hassle beforehand, in the form of printing one-time codes and storing them even in your wallet would help dramatically.

Re: Let them paste passwords (2017)

#53

Post by namdnay »

virgilp wrote: post #44
dheera wrote: post #40

Earlier quoted context omitted.

apt-get install xclip xdotool, then put this in ~/bin/paste #!/bin/bash sleep 2.0 xdotool type "$(xclip -o -selection clipboard)" If a website prevents you from pasting stuff just type "paste" and then click the field and wait 2 seconds.

You underestimate the ingenuity of some sites. Take this one: https://systemschimb.telekombanking.ro/login - enter a random user id, and behold the password input field: - all characters are separated (not one password field, but 10-15 ones) - some characters are randomly grayed-out (you're not supposed to enter all the characters of your password)

I like the system where you only enter parts of your password. It means that even with a key logger or hacked site, you’d need several logins to be able to scrape the password

Re: Let them paste passwords (2017)

#54

Post by namdnay »

Gibbon1 wrote: post #34
godot wrote: post #31

On this point: > write passwords down in places that are easy to find (like post-it notes next to the screen) Writing passwords on post-it notes is often used as a ridicule of non-tech-savvy folks behavior. I'd like to pose this question: If you're doing this not at an office, but at home, is this really so bad? Say you run a web site on AWS and write your really long AWS password on a piece of paper at home. It woul…

One solution is to use an easy to remember prefix with your passwords and only write down the secure part. Password is mayfly-DyHpE82sd3r3rvr!2sDQ Part you write down is DyHpE82sd3r3rvr!2sDQ

I used to write down numerical passwords interspersed number by number with a friends telephone number. Not exactly military grade security but enough to make it non obvious to someone looking through

Re: Let them paste passwords (2017)

#55

Post by wltprgm »

My piece of advie: Don't take your brain memory for granted

In this era of information technology everyone is bombarded with tons of data that they don't know how to think and memorize

Thinking and memorizing can strengthen your brain muscles but people hate exercising their bodies and their brains

I do use keepass for managing different passwords, but I kind of memorize most of them, only open keepass for storing them in case I ever forget

Re: Let them paste passwords (2017)

#56

Post by spicyramen »

One of the most useful changes to usability is displaying your password...when using mobile is a great advantage. Pasting can be useful in the mobile case as well. As sometimes typing in cellphones is not the easiest thing to do

Re: Let them paste passwords (2017)

#57

Post by choeger »

Gibbon1 wrote: post #34
godot wrote: post #31

On this point: > write passwords down in places that are easy to find (like post-it notes next to the screen) Writing passwords on post-it notes is often used as a ridicule of non-tech-savvy folks behavior. I'd like to pose this question: If you're doing this not at an office, but at home, is this really so bad? Say you run a web site on AWS and write your really long AWS password on a piece of paper at home. It woul…

One solution is to use an easy to remember prefix with your passwords and only write down the secure part. Password is mayfly-DyHpE82sd3r3rvr!2sDQ Part you write down is DyHpE82sd3r3rvr!2sDQ

You could also hash it with a common hash function and use the first X letters of the result string (if the website does not DEMAND "special characters", that is).

Re: Let them paste passwords (2017)

#58

Post by megapatch »

virgilp wrote: post #44
dheera wrote: post #40

Earlier quoted context omitted.

apt-get install xclip xdotool, then put this in ~/bin/paste #!/bin/bash sleep 2.0 xdotool type "$(xclip -o -selection clipboard)" If a website prevents you from pasting stuff just type "paste" and then click the field and wait 2 seconds.

You underestimate the ingenuity of some sites. Take this one: https://systemschimb.telekombanking.ro/login - enter a random user id, and behold the password input field: - all characters are separated (not one password field, but 10-15 ones) - some characters are randomly grayed-out (you're not supposed to enter all the characters of your password)

It is missfeatures like this which make me seriously doubt the competence of the site provider.

They then loose me as a customer, and everybody else who I can influence.

Re: Let them paste passwords (2017)

#59

Post by monadic2 »

viraptor wrote: post #28
jiggawatts wrote: post #14

Making password entry difficult is like attempting weight loss by eating bland food. It's not the flavour that makes you fat. Nonetheless, there's this perception that something delicious can't be good for a diet. People have this notion that to lose weight, there must be penance . An element of punishing oneself for past transgressions seems essential . Security people have the same mindset. Security must be a hassl…

> Security people have the same mindset. Security must be a hassle. It's an unhelpful generalisation. There are many jobs that could come under "Security people" and they work under different requirements. Many will agree with you on the hassle-free experience. There's no need for the us-vs-them.

Sure, but this isn’t engaging in the above poster in good faith.

Re: Let them paste passwords (2017)

#60

Post by monadic2 »

nine_k wrote: post #52
tialaramex wrote: post #21

Earlier quoted context omitted.

There was a recent discussion on HN that branches into this idea about the importance of UX. I agree with you, with a twist. What you want is that the happy path for security is zero hassle, but the unhappy paths should also drop dead with zero hassle. This is the UX I really like for WebAuthn / U2F. All the interactions on the happy path are very smooth. Need a second factor, tap, go. Almost frictionless. On my phon…

Another unhappy path is very difficult. Your phone got stolen or smashed. Your 2FA is just not available. Welcome to the sea of hassle proving your identity. But a little bit of hassle beforehand, in the form of printing one-time codes and storing them even in your wallet would help dramatically.

Proving identity is inherently not something you can solve technically, particularly without support from government.
Post reply on HN