Let them paste passwords
ncsc.gov.uk
Let them paste passwords
1–10 of 376 posts
Re: Let them paste passwords
#2As someone who has used password managers and exceedingly long, impossible to remember and cryptic passwords for years; this quite upsets me when sites prevent it
Re: Let them paste passwords
#3As someone who has used password managers and exceedingly long, impossible to remember and cryptic passwords for years; this quite upsets me when sites prevent it
I can't make any sense whatsoever of it. Does ANY scenario exist where this stops unintended access?
Re: Let them paste passwords
#4Of course it reduces security. It makes you resort to either
1.) typing it out manually while you can't see if you made a mistake
2.) using developer tools to set the 'value' attribute directly
"SPP" discourages use of a password manager. End of story. I also see this pattern used on banking websites for inputs like an account number. This drives me crazy as well for the same reason. The computer can get it right more reliably than my eyes and fingers.
Whenever I see a website that blocks paste I immediately assume it's built by incompetent people and trust it with as little as possible.
Re: Let them paste passwords
#5I can see some logic behind number 3 of having your password in the clipboard. It could lead to users pasting their password somewhere else where it was not intended. However, if you have malware on your machine that can read your clipboard, it can also simply read your keystrokes anyway.
Re: Let them paste passwords
#6Forbidding copypaste is equivalent to forcing one to recite his address and credit card details loudly in public every time he wants to enter his own house. In an age where videosurveillance is trivial to set up, it's just stupid; there is a reason every cash machine/atm asks you to cover the number pad as you type your PIN.
If the problem is the risk posed by password vaults and clipboard managers, promote better vaults and better utilities. Personally, I'd love a password vault that could check which application or website I'm pasting to, blocking transmission if it looks wrong. But it's not the website's job to tell me how to manage my secrets.
Re: Let them paste passwords
#7On Chrome you can use "Don't Fuck With Paste" to override these bad forms: https://chrome.google.com/webstore/detail/dont-fuck-with-pas...
Re: Let them paste passwords
#8"Justification 2: 'Pasting passwords makes them easier to forget, because you have fewer chances to practise them'."
if you can remember your password, its probably too weak
Re: Let them paste passwords
#9Of course it reduces security. It makes you resort to either 1.) typing it out manually while you can't see if you made a mistake 2.) using developer tools to set the 'value' attribute directly "SPP" discourages use of a password manager. End of story. I also see this pattern used on banking websites for inputs like an account number. This drives me crazy as well for the same reason. The computer can get it right mor…
I also worry when a site doesn't work with autocomplete. It's rare these days that the developers have actively tried to prevent it from working, but more common that an unnecessarily intricate sign-in flow makes the existence of the password field unrecognizable to the browser.
This makes me wonder about the personal security practices of the team that built it -- it's unlikely they typed strong passphrases hundreds of times a day during development -- and whether a secure site could come from such a team.
Re: Let them paste passwords
#10On Chrome you can use "Don't Fuck With Paste" to override these bad forms: https://chrome.google.com/webstore/detail/dont-fuck-with-pas...
I was hoping this would also prevent websites from messing with the input to the clipboard. It's a bit annoying to copy a sentence from a website only to have "Read more on XYZ!" appended to it.