4 ms·

Second worst password rule: preventing to paste in the password field. As seen at The OS X FileVault dialog, PayPal, Blizzard and many more....

• aruggirello 11y ago
  Third worst password rule: preventing the browser from prompting user to save the password for your site. I found this to usually happen with home banking sites (as a workaround, I usually have to disable and re-enable javascript).
• scintill76 11y ago
  Chrome hackaround: 1. Right-click the field, Inspect element. 2. Go to Console tab, type: $0.value = 'mypassword'; $0 is the last selected element: https://developer.chrome.com/devtools/docs/commandline-api https://developer.chrome.com/devtools/docs/commandline-api
  • carbonic 11y ago
    You can do this in FF and probably others by using this method: 1. click on the input field. 2. Type document.activeElement.value = 'MyPassword'; into the console.
  • dugmartin 11y ago
    I have this as a bookmarket named 'Reveal Passwords': javascript:(function(){var IN,F;IN=document.getElementsByTagName('input');for(var i=0;i<IN.length;i ){F=IN[i];if(F.type.toLowerCase()=='password'){try{F.type='text'}catch(r){var n,Fa;n=document.createElement('input');Fa=F.attributes;for(var ii=0;ii<Fa.length;ii ){var k,knn,knv;k=Fa[ii];knn=k.nodeName;knv=k.nodeValue;if(knn.toLowerCase()!='type'){if(knn!='height'&&knn!='width'&!!knv)n[knn]=knv}};F.parentNode.replaceChild(n,F)}}}})()
  • emsy 11y ago
    That's good for browser passwords, but finding out that your 64 character password can't be pasted in the system dialog after erverything is set up is extremely frustrating (there is a hard to find command line workaround though). I think Blizzard enforces the no-paste rule in its Battle.net launcher (that you can't trick) but I'm not 100% sure.
• throwaway125 11y ago
  Most of the time you can paste the password in another field (like the username) and select and drag it to the password field. Browsers should probably not allow that kind of interaction between javascript and the password field.
• z3t4 11y ago
  99% is probably stolen passwords and 0.0001% brute forced passwords.
  • vortico 11y ago
    A password thief surely wouldn't be stopped by a text box that doesn't allow Ctrl-V.
  • jakobdabo 11y ago
    No, 99% are the ones copied from a password manager application.
    • z3t4 11y ago
      If there is a Trojan, it can read the clipboard data. But most ppl save their password unencrypted. And can then be found by exploits in browser, java, flash, etc. Or unknowingly sharing the password file on a file-sharing network :P It's more secure to write it down on a piece of paper, then saving it on your hdd and copy/paste into the password box.
      • emsy 11y ago
        Why should a trojan bother to read files or clipboard data when it can read the password directly from the input field? You don't even need a trojan for this purpose, simple XSS at the right spot is sufficient. This means it's irellevant wether you write it on paper or in a file, since the password will be stolen when it's entered. The only thing you can do is to make sure your password is long enough so it can't be guessed, and that's where a password manager will help you.