Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let them paste passwords

ncsc.gov.uk

Post reply on HN
Print view View original

61–70 of 376 posts

Re: Let them paste passwords

#61

Post by blauditore »

noir_lord wrote: post #21
SurrealSoul wrote: post #16

Assuming you are creating an account, UN: Hello PW: World123 My largest issue is that its extremely possible to fat-finger your UN to be Hellow, and its extremely easy to see and fix that mistake. However since passwords are hidden its hard to see ######## is actually Worls123. Now your new account has essentially a one-time login because you have no idea what your password is. Typing it out again, ensures you catch…

I hate hidden passwords, it's stupid. I'd notice someone shoulder surfing so I'd prefer if they wheren't starred out by default with starring out as an option if I do have people around.

What about e.g. sharing a screen during a presentation?

Re: Let them paste passwords

#62

Post by majewsky »

thebouv wrote: post #49
sillysaurus3 wrote: post #10

Earlier quoted context omitted.

I was hoping this would also prevent websites from messing with the input to the clipboard. It's a bit annoying to copy a sentence from a website only to have "Read more on XYZ!" appended to it.

Fork the Don't Fuck with paste code and add that feature (or use it as an example to make your "Don't fuck with copy" extension). https://github.com/jswanner/DontFuckWithPaste I hate sites that do that (or prevent right-click as if that somehow secures their code).

I'd actually like an extension along the lines of "This is not Google Docs, for fuck's sake", that just disables all these APIs that are only ever useful with rich apps, but not with content-heavy websites, for example:

- copy/paste hijacking

- sensor access: microphone, camera, GPS, etc.

Maybe even go further and introduce some sort of rate-limiting for

- XHR requests

- relayout events

to save power and data.

Re: Let them paste passwords

#63

Post by majewsky »

simias wrote: post #24
BoorishBears wrote: post #20

Earlier quoted context omitted.

It's remembering one password vs X, and it is pretty hard to remember in my case, almost 4 months into using this password and I still struggle to type it in correctly sometimes

Yeah I was just kidding, I see what the parent meant. Now I use a hardware token (yubikey) to store my PGP key so I can use a relatively weak PIN code on it (since you need to have physical access to the device to use it and you only have 3 attempts before it locks up). It's a pretty good quality of life improvement.

> you only have 3 attempts before it locks up

Then you better don't use it when you're fatigued or drunk. I nearly locked my SIM card once by not realizing until the third attempt that my phone was asking for the SIM card PIN rather than my lockscreen PIN.

Re: Let them paste passwords

#64

Post by thesuitonym »

namdnay wrote: post #31
graphitezepp wrote: post #3

Earlier quoted context omitted.

I can't make any sense whatsoever of it. Does ANY scenario exist where this stops unintended access?

The only scenario I can accept paste-blocking is double-field password creation. At least one should refuse paste, just to make sure I haven't copied the wrong string. Whilst we're on the topic: I hate stupid input fields that don't ignore whitespace and have a maximum number of characters. So you paste the space-separated number (I'm looking at you IBAN), get an exception because of the spaces, go back and remove th…

>At least one should refuse paste, just to make sure I haven't copied the wrong string.

I disagree with this. If you paste a password into both fields, then paste it into your password manager, it doesn't matter if you've copied the wrong thing, because your password manager will still remember it.

Re: Let them paste passwords

#65

Post by nemoniac »

dmh2000 wrote: post #8

"Justification 2: 'Pasting passwords makes them easier to forget, because you have fewer chances to practise them'." if you can remember your password, its probably too weak

If you can remember your password, better not fly to the UK.

Re: Let them paste passwords

#66

Post by sanderjd »

dragonwriter wrote: post #53

If you are pasting passwords, you are really using an ad hoc third-party SSO authentication provider (which may or may not also use the equivalent of 2FA) via a manual token-exhange mechanism. Better than allowing pasting passwords, just support OpenID or some similar federated authentication solution, which does the same thing without manual token exchange and the attendant opportunities for errors. You might want t…

Think of it this way: passwords are a more standard API than OpenID. Since passwords are the standard, they are "implemented" by all your clients. That cannot be said for OpenID.

Re: Let them paste passwords

#68

Post by reacweb »

thesuitonym wrote: post #58
artursapek wrote: post #4

Of course it reduces security. It makes you resort to either 1.) typing it out manually while you can't see if you made a mistake 2.) using developer tools to set the 'value' attribute directly "SPP" discourages use of a password manager. End of story. I also see this pattern used on banking websites for inputs like an account number. This drives me crazy as well for the same reason. The computer can get it right mor…

Other signs that a site was built by incompetent developers (Or had too much management interference--Devs aren't always to blame!): Only works with Internet Explorer Doesn't work with Internet Explorer Password must have one of 4-10 special characters, but not other special characters. (e.g.: Must contain !, @, ^, &, or parentheses, but not ;, ", etc) Passwords have no requirements Right-click is disabled Video play…

I agree with all your points except slideshows. Why so much hate against slideshows ?

Re: Let them paste passwords

#70

Post by tclancy »

thesuitonym wrote: post #58
artursapek wrote: post #4

Of course it reduces security. It makes you resort to either 1.) typing it out manually while you can't see if you made a mistake 2.) using developer tools to set the 'value' attribute directly "SPP" discourages use of a password manager. End of story. I also see this pattern used on banking websites for inputs like an account number. This drives me crazy as well for the same reason. The computer can get it right mor…

Other signs that a site was built by incompetent developers (Or had too much management interference--Devs aren't always to blame!): Only works with Internet Explorer Doesn't work with Internet Explorer Password must have one of 4-10 special characters, but not other special characters. (e.g.: Must contain !, @, ^, &, or parentheses, but not ;, ", etc) Passwords have no requirements Right-click is disabled Video play…

Not allowing + in an email field is one of my pet peeves. Congrats on finding an amazing-looking regex for email validation instead of thinking about it.
Post reply on HN