Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let them paste passwords

ncsc.gov.uk

Post reply on HN
Print view View original

81–90 of 376 posts

Re: Let them paste passwords

#81

Post by tomku »

SurrealSoul wrote: post #16

Assuming you are creating an account, UN: Hello PW: World123 My largest issue is that its extremely possible to fat-finger your UN to be Hellow, and its extremely easy to see and fix that mistake. However since passwords are hidden its hard to see ######## is actually Worls123. Now your new account has essentially a one-time login because you have no idea what your password is. Typing it out again, ensures you catch…

Pasting the password from an authoritative source like a password manager also eliminates that mistake, and works safely whether there's a password confirmation field or not. Even better if your password manager can generate a new password, fill it into all applicable spots on a registration form and save it into its database from a single button press so you have no chance to screw anything up.

Re: Let them paste passwords

#82

Post by ErrantX »

artursapek wrote: post #4

Of course it reduces security. It makes you resort to either 1.) typing it out manually while you can't see if you made a mistake 2.) using developer tools to set the 'value' attribute directly "SPP" discourages use of a password manager. End of story. I also see this pattern used on banking websites for inputs like an account number. This drives me crazy as well for the same reason. The computer can get it right mor…

It's interesting that a lot of us are assuming that pasting encourages the use of password managers.

However; I worry that this is a very BIG assumption.

Even in my IT-literate circles password management usage is low.

In my non-IT circles it is non-existent, and not because of SPP particularly; I suspect SPP (which I agree is silly) derived from an understanding that allowing an average person to paste passwords meant they stored them in passwords.txt on their desktop.

Naturally the population here is technical so it can be hard to see that as a common and sensible thought process. But never underestimate the capacity of the average person (who's IT capability you and I don't represent) to make mistakes like this and never see the problem/risk.

It's odd that the article explicitly mentions this near the start but then doesn't address it in the Justifications section.

Re: Let them paste passwords

#83

Post by jmkni »

artursapek wrote: post #4

Of course it reduces security. It makes you resort to either 1.) typing it out manually while you can't see if you made a mistake 2.) using developer tools to set the 'value' attribute directly "SPP" discourages use of a password manager. End of story. I also see this pattern used on banking websites for inputs like an account number. This drives me crazy as well for the same reason. The computer can get it right mor…

I use a password manager to generate long, complex passwords for every service I use (as complex as the service will allow).

For sites that disable pasting, I have developed quite a skill at copying the password character by character from my PM into the password field. I'm even starting to remember a couple of them.

Incredibly frustrating.

Re: Let them paste passwords

#84

Post by jameshart »

joshvm wrote: post #78
thesuitonym wrote: post #58

Earlier quoted context omitted.

Other signs that a site was built by incompetent developers (Or had too much management interference--Devs aren't always to blame!): Only works with Internet Explorer Doesn't work with Internet Explorer Password must have one of 4-10 special characters, but not other special characters. (e.g.: Must contain !, @, ^, &, or parentheses, but not ;, ", etc) Passwords have no requirements Right-click is disabled Video play…

We had a gem at my last university (UCL): you must rotate your password every few months, your password can't be anything like any of the previous ones (i.e. previous ones are stored, and they're not hashed), your password must contain special characters etc. Except.. it can only be 8 characters long. Anything else gets truncated (they explicitly said so). The mind boggles. I have no idea where this limitation comes…

> your password can't be anything like any of the previous ones (i.e. they're not stored hashed)

That's... not necessarily the case. You can implement that check by only storing hashes of previous passwords, or of patterns derived form them that are also forbidden (e.g. store a bcrypt of every previous password converted to all lowercase and with numbers and symbols removed).

Re: Let them paste passwords

#85

Post by maxxxxx »

sanderjd wrote: post #72
maxxxxx wrote: post #38

This whole discussion is a good example for everything that's​ wrong with computer security. Instead of coming up with solutions that make it easy for people to follow good practices the "experts" make it even more cumbersome. Most people just want to use the computer and not think about security.

Your comment would be interesting if it brought some ideas to the table. Lots of people work hard to come up with ideas that strike a good balance on the really difficult trade off between security and convenience. Comments like yours that seem to imply this should be really easy, but don't provide any ideas, aren't very helpful.

If I had a good idea I would have provided it. I wish I had one.

What I am saying is that from a regular user's perspective there is no viable way to do it right and we shouldn't be surprised if people follow bad practices. We can't just tell people to:

- don't write down passowrds - have unique strong passwords for dozens of sites - always type them in

It's not going to happen.

Re: Let them paste passwords

#86

Post by blakesterz »

mrob wrote: post #29
dmh2000 wrote: post #8

"Justification 2: 'Pasting passwords makes them easier to forget, because you have fewer chances to practise them'." if you can remember your password, its probably too weak

>if you can remember your password, its probably too weak As XKCD famously pointed out[0], Diceware[1]-style pass phrases can be both secure and memorable. XKCD's four word example isn't secure when fast brute-force attacks are feasible, but eight words is still easily memorable and secure enough for anything. The important point here is that "random words" really does mean "random", i.e. not picked by a human. [0] h…

I thought password cracking machines now guess words as well as characters? Like they will guess all 8 character passwords and will also guess all 6 word passwords using common words like they guess characters? Therefore using just a few common words stuck together with nothing else is no longer secure? (This is a genuine question because I could be totally wrong on that, I can't even remember where I heard it)

Re: Let them paste passwords

#87

Post by discreditable »

mrob wrote: post #29
dmh2000 wrote: post #8

"Justification 2: 'Pasting passwords makes them easier to forget, because you have fewer chances to practise them'." if you can remember your password, its probably too weak

>if you can remember your password, its probably too weak As XKCD famously pointed out[0], Diceware[1]-style pass phrases can be both secure and memorable. XKCD's four word example isn't secure when fast brute-force attacks are feasible, but eight words is still easily memorable and secure enough for anything. The important point here is that "random words" really does mean "random", i.e. not picked by a human. [0] h…

I've come to be a big fan of diceware-style passphrases. I even wrote a generator for them based upon the EFF's wordlist: https://spg.brashear.me

Re: Let them paste passwords

#88

Post by hn_throwaway_99 »

_jal wrote: post #57

In general, more and more sites encourage me to just leave Javascript turned off all the time. If they break, screw them, I'll go elsewhere. The only sites "sticky" enough to make me put up with it are financial, and that's only because they all suck so changing solves nothing. 'Missing out' on Angular sites hasn't left me feel like I'm missing anything in my life. This ties in to the discussion of Craig's List the o…

> If they break, screw them, I'll go elsewhere.

I think that option is going to greatly constrain where you are able to go on the web. The vast majority of ecommerce sites I visit will break with JS completely turned off.

Re: Let them paste passwords

#89

Post by simias »

majewsky wrote: post #63
simias wrote: post #24

Earlier quoted context omitted.

Yeah I was just kidding, I see what the parent meant. Now I use a hardware token (yubikey) to store my PGP key so I can use a relatively weak PIN code on it (since you need to have physical access to the device to use it and you only have 3 attempts before it locks up). It's a pretty good quality of life improvement.

> you only have 3 attempts before it locks up Then you better don't use it when you're fatigued or drunk. I nearly locked my SIM card once by not realizing until the third attempt that my phone was asking for the SIM card PIN rather than my lockscreen PIN.

There's also an "admin PIN" that can be used to unlock the key if something goes wrong. It's more complicated than my regular PIN and I didn't memorize it so that should be enough as a defensive measure against drunk me.

Well, unless I'm silly enough to try and bruteforce that PIN as well, after 3 failures I'd be left with an expensive piece of plastic... Fortunately I'm rarely that drunk.

EDIT: Actually as the sibling comment points out you can still reset the token even if you mess up the admin PIN. So at least you won't "brick" your token completely.

Re: Let them paste passwords

#90

Post by tomku »

hammock wrote: post #11

Everyone's talking about password at sign-in or credit card numbers but that's not the only use case for paste restriction. The more common place I've seen it is email address confirmation (or PW confirmation), which while probably unnecessary, is not the worst thing in the world. You are retyping an address that's displayed in the field above. Less intrusive than a captcha.

Blocking pasting in a password confirmation input accomplishes nothing because you're already blocked from copying the contents of the first password input anyways. All it does is inconvenience people who use password managers.
Post reply on HN