24 ms·

The “Cobra Effect” that is disabling paste on password fields

• TazeTSchnitzel 10y ago
  Disabling paste on changing password strikes me as a good idea. If you're not pasting from a password manager, it's easy to accidentally select additional whitespace or miss the first or last character. If you then paste it, you end up with a different password than you thought. But for login, I see no reason to prevent it.
  • happyslobro 10y ago
    What? The password comes from the password manager in the first place! Please people, do not break shit just to protect me from my own sloppy mistakes.
• MichaelBurge 10y ago
  I could see it having at least some benefit if you not only disabled paste, but tracked the individual letters as they were typed in. It'd give you a little statistical information, like how Google watches how you click a checkbox for a captcha. But it seems like an actual captcha would be better, then.
• lstamour 10y ago
  Great article. The only point missed is that password length limits AND re-type fields AND disabling copy and paste are all measures that when, implemented correctly, are supposed to help you remember your password and prevent easy access to reset mechanisms by forcing you to type it twice and not accidentally copy and paste it twice. Of course, in an era where weak password re-use and leaked hashes are one of the biggest problems facing normal internet users, we really should re-evaluate all the above assumptions. Or if it's too hard, let email providers handle the login security requirements... Since most places allow email-based password resets anyway.
  • dkbrk 10y ago
    I understand the desire to stop stupid users from being stupid, however outright preventing user best practice unless they resort to somewhat exotic workarounds is completely inexcusable. > we really should re-evaluate all the above assumptions I would not consider anyone supporting these practices remotely competent. There should not be any need to re-evaluate anything.
  • morgante 10y ago
    > remember your password Starting with the premise that users should be remembering passwords at all is a mistake.
• draw_down 10y ago
  Disagree that it's a conscious decision on the developers' part. Developers get told to do this, so they do.
  • bluejekyll 10y ago
    Developers don't need to be mindless code punchers. They can be thoughtful individuals who say, "that's dumb", and then have a discussion with the PM on why that is dumb. On the other hand, maybe development of software is a mindless endevour, and so the labor in this area must be cheap, right?! </sarcasm>
    • dhoe 10y ago
      You're right, of course, but it's also true that in a real life environment, you've already found a polite way to say "that's dumb" three times this morning and you're starting to pick your battles.
      • bbcbasic 10y ago
        This! Dilbert is a documentary not a cartoon. Devs work for businessfolk. Businessfolk have the control call the shots. Sure they'll listen to devs but get the final say.
        • kkarakk 10y ago
          Couch your suggestions in business terms? user engagement decreases when you don't let them save their passwords or some such drivel. honestly if you think businessfolk call all the shots, you may have a broken business relationship
          • bbcbasic 10y ago
            Ultimately they call the shots because they'll judge the developers idea and say yay or nay. All a developer can do is influence and with a given number of battles to fight, password copy and paste may be a long way down there. It requires getting promoted to management or board level to get the ultimate decision power. Some companies are more progressive when their board chooses to be but they can always revert back if they choose or get taken over.
• markcerqueira 10y ago
  Fortunately, it's not hard to get around this on desktop (for Mac at least) with an applet like Paste Typer. But when I see this on iOS it infuriates me. I use 1Password to generate strong (long) passwords and having to type them out manually is a huge PIA.
  • x1798DE 10y ago
    On Android, KeePassDroid registers as a keyboard to prevent other apps from retrieving your passwords from the clipboard. Not super familiar with iOS, but it seems like a good practice anyway, independent of its utility in circumventing asinine "no pasting" policies.
    • Larrikin 10y ago
      1Password does too but I've found that the Chase app and the Google Account manager all fail silently when using the keyboard to paste in your password. I called up Chase and they had no idea about why it wasn't working, although they could see my login attempts. I only was able to figure it out when I changed my gmail password to something stronger and couldn't log back in and had to google the problem.
    • russjr08 10y ago
      On iOS, you can't use any third party keyboards on a password field. It just switches back to the system keyboard.
  • dingo_bat 10y ago
    I have a Microsoft touch mouse, and I can program macros on the touchpad's regions. So if I press the top/middle part of the thing, it just types my password :) In fact, now that I'm thinking of it, I can use it to trigger a script which will type whatever is in the clipboard. Silly javascript script kiddies think they can control a user's behavior like this.
    • djrogers 10y ago
      Passwords are like underwear - sharing them is a really bad idea. You shouldn't have 'a' password - every site should have a unique one.
• level3 10y ago
  I always assumed it was for the same reason sites make you enter your email address twice without pasting - to reduce the chance of mistyping. If you only have to enter something once, then you could easily mistype it and then you end up with an account you can't log in to or even recover. But if you have to type it twice, then the chance is greatly reduced, since you'd have to make the exact same typo twice in a row. Edit: This is regarding account creation/changes like the PayPal example. I have no idea why login forms would disallow pasting.
  • morgante 10y ago
    That's still not a very good reason. If you're security conscious, you shouldn't be typing passwords at all. You should generate them from a password manager and paste them into the field both times. It boils down to security theater making us all less secure.
    • madeofpalk 10y ago
      Not concerned about security, but about the direct user experience. The user won't know that they've mistyped their password, won't potentially won't return when they can't log into their account.
      • Retr0spectrum 10y ago
        Why not just disallow copying from the first field? That way, password manager users can paste into both fields, but users who are hand-typing are forced to avoid mistakes.
        • makomk 10y ago
          Sites already do, but that doesn't stop users from copy-and-pasting from password generators or typing the password elsewhere and copy-and-pasting that twice.
          • Retr0spectrum 10y ago
• ars 10y ago
  Luckily middle click paste on unix seems to bypass everything. It doesn't trigger not copy events (so the website can't mess with the text), nor paste events. Just the way it should be.
  • vacri 10y ago
    I feel like I'm missing a GUI-limb when I'm on Windows and don't have the highlight buffer/middle-click paste...
    • hyperdimension 10y ago
      TXMouse[0]--I've been using it for years. It's just what you want. 0 - http://fy.chalmers.se/~appro/nt/TXMouse/ http://fy.chalmers.se/~appro/nt/TXMouse/
      • effie 10y ago
        Sadly did not work very well for me with Windows 7. In some situations it works like in X11, in some nothing happens (no copy/paste). Breaks opening links with middle click... Is there some alternative or fix that would make it function more like in X11 ?
  • kccqzy 10y ago
    The article outlined a way for websites to check this: count the number of key press events (filtering modifiers of course) and the number of characters. Or you can imagine a particularly asinine site performing some statistical analyses on your keystroke timing (flight time and dwell time) and even deduce whether it's typed by a human or not. The thing is, this is a policy issue, not a technological issue.
    • astrodust 10y ago
      If it's JavaScript, you can script that out in your client. Honestly there's no reason to do this bullshit of disallowing pasting client-side. If pasting is a problem, if your machine is compromised, it's got a key-logger too. Those on-screen keyboards to try and foil that vector basically presumes everyone's infected, and so, encourages weak passwords that are more likely to be brute-forced by an adversary not using that interface.
• fit2rule 10y ago
  One reason to dissuade users from using the clipboard to paste passwords is this: the password stays in the clipboard. Not all users realize this, and so .. don't 'clear' the clipboard after logging in .. which means their password is still available to anyone else who might use that computer.
  • lisivka 10y ago
    So, login form can just clear clipboard instead in onsubmit() handler.
    • justaboy21 10y ago
      You can't alter the clipboard from JS (you can on browsers that support the execCommand API but still).
    • danjc 10y ago
      That's an interesting idea actually. My first response was that you can't freely interact with the clipboard but you can set it provided you do it in response to a js event so in theory that is possible. The only problem is that you'd need to be sure the clipboard did actually contain the password because of course you can't read it. I guess you can log whether onpaste fired and then if the login button is clicked with a second or two, clear the clipboard.
      • danjc 10y ago
        And by 'clear', I mean add a textbox, set its value to an explanatory message '{app} cleared the clipboard because it contained your password' and then execCommand on it.
    • happyslobro 10y ago
      Hopefully there is nothing important in the clipbkard, like some data that the user will attempt to submit a second time after logging in. It sounded like a good idea at first, but now I want my +1 back :p
• morgante 10y ago
  The worst is websites which not only disable pasting but don't even let you type your password in. Instead you have to use their janky on-screen keyboard to fumble your way through login. I got so fed up with TradeKing (which has horrible security practices in general) that I close my account.
  • BinaryIdiot 10y ago
    > don't even let you type your password in. Instead you have to use their janky on-screen keyboard to fumble your way through login. Wow that's just insane. I'm glad I haven't run across any services like that. I'm not sure what their line of thought it; it only inconveniences normal users. A person attempting to try multiple passwords can likely figure out how to get around that restriction without issue.
    • morgante 10y ago
      > I'm not sure what their line of thought it; It's theoretically a defense against key loggers. Of course, if someone has compromised your machine to the point where they're tracking key strokes there's no reason to assume they can't also grab your mouse presses and websites. This isn't even their worst security practice. What truly got me to leave was their security questions: they're presented as multiple choices. My randomly generated string stands out rather obviously next to the "typical" choices.
      • pm 10y ago
        This is where convenience trumps security. Virgin Money used to require you to enter your password using an on-screen keyboard, except they REARRANGED THE LAYOUT EVERYTIME YOU USED IT. Thank fuck they eventually got rid of it, but it was such an abject pain in the ass, I cringed everytime I needed to log in to view my details.
        • MereInterest 10y ago
          I wouldn't even call it a trade-off between convenience and security, because there is no security gained. This is a trade-off between convenience and stupidity. If someone suspects that a keylogger is there, the entire computer should be assumed to be compromised. Trying to guess the capabilities of the keylogger and working around them is ludicrous.
• khattam 10y ago
  >Sometimes you want to use the same credentials on multiple domains of the same service and auto-fill only works against the domain the pattern was recorded on. That's why you should use Lastpass.
  • astrodust 10y ago
    I've tried to use Lastpass but that thing needs a UX enema because it's atrociously bad.
    • BinaryIdiot 10y ago
      Oh good so I'm not alone! I tried setting it up but trying to mass import multiple passwords from KeePass over (which doesn't translate directly 1 to 1) left me manually entering them. The process was so incredibly slow and cumbersome that I gave up. It doesn't help that LastPass looks like it was created in 2003 by developers with zero UX / design talent. I hope they can improve that one day.
      • ohthehugemanate 10y ago
        When did you try it? It very recently went through a total ux overhaul. Big improvement imo.
        • astrodust 10y ago
          It's gone from apocalyptically bad to horrendously bad. I have no idea where they thought any of that UX would be even remotely a good idea. Everything about it is misguided to such an extreme I'm left wondering if there's a single human on their development team. 1password may not be perfect, but their attention to usability is obvious!
        • BinaryIdiot 10y ago
          About 6 months ago. Perhaps I'll take another look but I haven't heard good things from anyone I know who uses it.
• 0xCMP 10y ago
  On OSX using Hammerspoon to type from the clipboard into whatever for you has been a life-saver for me. Especially ever since Apple disabled pasting for decrypting external drives.
• Spydar007 10y ago
  Windows doesn't let you paste when changing your password either. It's annoying.
  • dingo_bat 10y ago
    Windows doesn't let you paste whenever you are in one of those 'elevated' contexts, like the login screen. In fact, this prevents my nifty mouse macros from running too.
• dwg 10y ago
  Until better minds prevail.., Disable JavaScript, paste password, enable JavaScript, login. A pain, but usually effective.
  • gruez 10y ago
    Unless the login page needs JavaScript to work (like SPA)
    • djrogers 10y ago
      No, this should still work. Kid the page, let JavaScript run. Kill js, paste your password, then re-enable js before hitting submit
      • nommm-nommm 10y ago
        Or just directly edit the DOM.
  • 0xfeba 10y ago
    Paste the password at the end of the address bar, select and drag it to the password field. Doesn't count as a paste, just a "change".
• dandelany 10y ago
  Not that I think it's a good reason, but I think the rationale behind disabling paste is to prevent users from implementing their own "password managers" via a .txt file full of passwords on their Desktop (more common than you'd think).
  • morgante 10y ago
    Why though? A .txt file on the desktop is actually probably a lot more secure than using the same shitty password on every site.
    • im3w1l 10y ago
      A friend may get tempted to sneak a peek.
      • kintamanimatt 10y ago
        That's pretty tough with FDE, proper permissions on the text file, an ephemeral guest account for the times someone wants to use your computer, and religiously locking the screen when AFK.
      • robbbbbbbbb 10y ago
        Your friend could just as easily install a keylogger and get everything anyway.
        • im3w1l 10y ago
          Theorethically yes, but there is a much bigger psychological barrier to doing that.
      • ygra 10y ago
        You may want to get more trustworthy friends ...
  • onion2k 10y ago
    I'd rather a user has a strong password that they paste from a file than a weak password they can type easily. If their machine is hacked then it's game over anyway. At least using a txt file of strong passwords means their account is secure if the online service is compromised.
• saynsedit 10y ago
  For a mathematically rigorous password strength meter library, check out zxcvbn: http://github.com/dropbox/zxcvbn http://github.com/dropbox/zxcvbn
• ejcx 10y ago
  I always assumed this anti-pasting was a requirement of some braindead auditor who insisted that this was a necessary security mechanism. If they aren't, there's a lot of "debt" in the passwords space, like Troy mentions. This is just something that will get better as websites get better. Webapps are much more complicated today than 5 years ago, on average, and as complexity increases things like user auth will get better and more homogeneous. This is especially true if Google and Apple have their way with the Credential Management RFC and get people to have a reason to save their passwords with chrome. "Passwords" are getting better but we need another 5 years to get us there.
  • rwmj 10y ago
    I had a quick look through PCIDSS which is the usual source of this kind of nonsense, but couldn't see anything. However when the first site in the posting talked about losing their "security certificate" they were almost certainly talking about PCI or some related standard.
• nothrowaway 10y ago
  If it helps anyone, this Chrome extension has worked every time I've tried it: https://github.com/jswanner/DontFuckWithPaste https://github.com/jswanner/DontFuckWithPaste (I usually keep it disabled, but enable it when I'm about to use a site that has paste disabled on any fields.)
  • fakemeatsubs 10y ago
    Awesome, is there a similar one for selecting text and copying?
    • nothrowaway 10y ago
      Very possibly, but I don't know of one to recommend, sorry. (Temporarily disabling JavaScript is sometimes an option.)
  • rsync 10y ago
    "If it helps anyone, this Chrome extension has worked every time I've tried it: https://github.com/jswanner/DontFuckWithPaste" https://github.com/jswanner/DontFuckWithPaste" Shouldn't chrome itself be a "don't fuck with paste" tool ? As the world moves to the browser as the OS (essentially) it's imperative that the browser respect end user wishes and behave as a sentry against malicious websites and malicious website behavior.
    • delecti 10y ago
      Most of the time websites disable paste by registering "onPaste" events. How do you allow websites to keep doing that when necessary, but not allow the websites that break the paste?
      • ketralnis 10y ago
        > when necessary When would I ever want a website to know the difference between me pasting and me typing some text?
• anexprogrammer 10y ago
  This is from 2014. I'd forgotten the Cobra Effect but remembered the BG tweet. :)
• Khaine 10y ago
  Any web developer who does this should be shot. Same with silently dropping characters from passwords when signing up and poor validation of email addresses
  • marvel_boy 10y ago
    Absolutetly agree. Shot twice, this way will no repeat
  • simbalion 10y ago
    that seems a bit extreme I think you could just fire them and hire a better developer, then they might learn their lesson.
  • wila 10y ago
    Nah, they simply should take away the developer's own paste functionality so that they can no longer paste code from websites. ;)
  • ebiester 10y ago
    In my experience, the developer is protesting furiously but has a rent payment and quit on the spot.
• simbalion 10y ago
  It always amazes me that someone is hired to implement strong security and they come up with things like paste-blocking. Or "security questions." Security questions are a social engineers best friend. Unless you're savvy and your answers are all strong passwords themselves, and if they are you're probably using keepass or something like it with 400+ bit passwords and you hate wasting time on security questions too.
  • chjohasbrouck 10y ago
    It's amazing to me how insecure email is these days. If you know somebody's email, and you have a plausible reason to have a conversation with them, you can very easily take over their email account and reset the password on every account attached to it. I often wonder how much the security of email (and by extension, every other account online) depends on people just not knowing how simple and easy it is to break into. If everyone knew, we'd be living in chaos right now, right?
    • Twisell 10y ago
      This exactly why all my e-mail passwords are at least 18 character long with random generated gibberish stored on a keychain... And to secured that keychain I use a very long login password (XKCD style + numbers) that always make people cringe. In return I assert a well deserved facepalm when I see a friend log in on his e-mail account with a variation of "Password1".
      • oolongCat 10y ago
        That sounds like a very tedious thing to go through to login to your email. Just use a strong password ( https://xkcd.com/936/ https://xkcd.com/936/ ) The funny thing with having email as a username is, how sometimes people can use social engineering to gain control of your account, non of that fancy "hoaxer" stuff are needed when your service providers put untrained people in charge of your accounts. Hacking human stupidity is a more effective way in to get in to a secure system. ( as an example, this was on reddit just yesterday https://www.youtube.com/watch?v=lc7scxvKQOo https://www.youtube.com/watch?v=lc7scxvKQOo )
• alimw 10y ago
  Is it really necessary to portray an initiative to wipe out dangerous snakes as self-interested and imperialist?
  • alimw 10y ago
    Obviously it's self-interested for the species as a whole...
  • pje 10y ago
    He never described the _initiative_ as imperialist, just the British rulers. Since the British rule of colonial India is virtually the dictionary definition of imperialism, I'll go ahead and call the author's word choice reasonable.
    • alimw 10y ago
      While you're in the dictionary you might look up the word portray.
      • alimw 10y ago
        It's true that the article doesn't describe the initiative as imperialist in so many words, but it does portray it as such in the sense of putting "imperial or sovereign interests over the interests of the dependent states" [1]. I apologise, my use of the word "imperialist" was quite redundant as I had already used "self-interested". I further apologise for extending this tedious game of definitions but since I have now been flagged as well as downvoted, I can only assume that my original comment was desperately unclear. [1] http://www.dictionary.com/browse/imperialism http://www.dictionary.com/browse/imperialism
• jrockway 10y ago
  I encountered this once. "xdotool type password". If they're checking for a delay, xdotool can introduce that for you (defaults to 12ms though). That said, we should never have let websites have this kind of control over the user agent. For the one time disabling right click was helpful (context menus in Google Docs), 99% of the time it's something dumb ("don't steal our images!"). Finally, I loved the comment about losing their security certificate. I'm sure the average CA will give you a cert for google.com if you ask nicely enough.
• foz 10y ago
  I believe that copy and paste is needed in login forms, as a UX expectation. Typing a secure random password is really painfully hard, especially on mobile. Sometimes password managers don't recognize the target form fields correctly, so copy/paste is the next step. The act is even encouraged through the use of convenient helper buttons in the password managers. However. In MacOs Sierra, Apple will introduce the Universal Clipboard feature. This means when someone copies a password on desktop, it would be available on their phone. Which is just one step away from being pasted, by mistake, into an IM chat or worse. I'm uncomfortable with the idea that when I copy something it's being sent around to different devices, and available to everything running. I've actually made the terrible mistake of doing that - pasting a password into a group chat my accident, because I didn't copy text correctly, and my last paste buffer was still around. Or messing up when using pbcopy/pbpaste in a shell script. 1Password for instance can actually reset the copy/paste buffer after some time, but the settings need to be enabled. I wonder if Apple has any kind of security around this planned. Maybe applications and scripts should not be able to access the paste buffer until the user explicitly allows it (via the act of using it)?
  • JupiterMoon 10y ago
    KeepassX on linux resets the buffer after 15 seconds.
  • AlexandrB 10y ago
    >However. In MacOs Sierra, Apple will introduce the Universal Clipboard feature. This means when someone copies a password on desktop, it would be available on their phone. Which is just one step away from being pasted, by mistake, into an IM chat or worse. If Apple has any sense at all they will allow apps to mark content being put in the clipboard as local-only. Otherwise this feature will leak all kinds of information intended to be private (passwords, stuff copied from incognito browser windows, financial information from tax software, etc).
    • Aaronn 10y ago
      Yes, Apple has thought about this: https://twitter.com/1Password/status/743198373323341832 https://twitter.com/1Password/status/743198373323341832
• Twisell 10y ago
  Every time I see an apparently stupid security restriction reason I feel obligated to check if "Password1" is a valid entry... You won't ever believe how often this work while gibberish keychain-generated passwords get rejected because they contain a "-" character ... Wake up IT departments it can't always be users fault. People born with Window95 starts to work, they won't take your shady security reasons for granted as did people born in the 60's! They just will just think that your are incompetent...
• oakwhiz 10y ago
  Disabling pasting on forms is like... security through cargo cultism. If we make things seem secure, maybe the bad guys will just leave us alone!
  • etatoby 10y ago
    There's a lot of cargo cultism in modern UI design.
• happyslobro 10y ago
  I have a crazy idea: what if we held people responsible for their own mistakes, instead of turning the world into a padded room? You messed up your password? Reset it. You have a virus / XSS that is slurping the clipboard? It's probably logging keystrokes too, and that's not the devs problem (well, XSS is, but blocking paste isn't the solution)
  • tirant 10y ago
    Why do you want to punish people even more instead of trying to educate them and help them? You and me probably do not make mistakes in this subject: but we have to admit we are both lucky and got enough education/insights to be able to handle security 'right'. Most of the population are not that lucky.
    • happyslobro 10y ago
      Forcing users to type out passwords does not educate them, or even encourage good habits. All it does is frustrate people who already have good password management habits, and encourage those who don't to keep (re-)using passwords that are easy to remember and quick to type.
  • konschubert 10y ago
    I agree that the security theater is annoying, and uselsess, but I think you are drawing the wrong conclusion. Sometime in the 1960s we realized that we can't reduce fatal car accidents by "holding people accountable for their own mistakes". We actually have to make cars safer.
    • happyslobro 10y ago
      That's different, people can't learn from fatal accidents. They do learn not to ignore the "check oil" indicator though, we don't need to disable the engine to make people pay attention to that. This is acceptable, even if it costs the occasional fool an engine.
  • wpietri 10y ago
• darkhorn 10y ago
  In Turkey there must be law which says that mobile carriers must cooperate with banks because when I enter my ID and my first password to the web page of the bank it says "oups! it appears that you have changed your SIM card, please re-validate yourself before we SMS you a 2fa password". And in Bulgaria I saw use of client-side certificates.
• CarolineW 10y ago
  Although relevant, this dates from 2014. It's been submitted a few times, although the only time it got any discussion was here: https://news.ycombinator.com/item?id=7832938 https://news.ycombinator.com/item?id=7832938 There were 33 comments on that submission, so that discussion might be relevant. I wonder if this discussion repeats any of the points made there ...
• MichaelGG 10y ago
  Why do browsers all them to do this? Surely there should be some way to determine it's just a textbox and prevent the side from screwing up the user's actions? Same for autocomplete.
• deleted 10y ago
  [deleted]
• matt_morgan 10y ago
  Is there a way to disable just pieces of JS, so I can turn off "onpaste"? note: sorry, accidentally deleted earlier version of this comment.
  • MrQuincle 10y ago
    Javascript injection returns quite a few hits. For example for Chrome: https://chrome.google.com/webstore/detail/css-and-javascript-inject/ckddknfdmcemedlmmebildepcmneakaa?hl=en https://chrome.google.com/webstore/detail/css-and-javascript...
  • matt_morgan 10y ago
    Found Stack Overflow discussion with some suggestions: http://superuser.com/questions/858082/how-can-i-selectively-disable-paste-blockers http://superuser.com/questions/858082/how-can-i-selectively-...
  • bbarn 10y ago
    I just added it to my list of stuff that pushing this bookmarklet button fixes: javascript:void(document.onmousedown=null);void(document.onclick=null);void(document.oncontextmenu=null);void(document.onpaste=null)
    • thameera 10y ago
      Wouldn't setting `onclick` to null break desired functionality in some sites?
      • NegativeLatency 10y ago
        Sure would. You couple just reload the page after logging in though.
    • jameshart 10y ago
      Off topic note, but this comment causes this page to be nearly unreadable on iPhone, because it doesn't line wrap. Should probably be something in the HN CSS to fix that.
• tyfon 10y ago
  Here in Norway, almost all financial and government institutions allow a form of authentication called BankID (https://www.bankid.no/en/company/ https://www.bankid.no/en/company/). I use the mobile variant and it works for all government related stuff like taxes, health, relocation notices and also with all banks both when logging in and paying bills, signing contracts etc. It is a legally binding identification akin to signing a paper. The procedure for the mobile version is to input your phone number and birthday on the login and you get a popup on the phone (via the gsm network and sim toolkit, not ip) to input your password along with a short phrase like "pink bridge" so you can verify that it was the web page that sent it. This also works with a lot of credit cards for paying online via 3dsecure. It's become so common that a large majority of our customers (I work in a bank) are using this as the sole mechanism of identification. (And yes, for the non mobile version of BankID you can paste the password!)
  • megalodon 10y ago
    This is what we use here in Sweden as well. The reason it works is that all inhabitants are given a personal identification number upon birth, that consists of our birthday + 4 digits which are loosely based on where we are born and if we are male/female. This number is unique for every person and is used to register to the BankID service (among other things) and ensures that it is connected to a single individual.
    • hk__2 10y ago
      > The reason it works is that all inhabitants are given a personal identification number upon birth Isn’t that the same as the Social Security/National Insurance number you get in various countries? In France you have a unique number that depends on your sex, where you’re born, 3 more digits to differentiate you from all other people of the same sex that were born the same day at the same place and then a final digit for a checksum.
      • megalodon 10y ago
        You are probably right, I added that part in because I read somewhere that not all countries maintain lists of personal identities as comprehensive but that might have been a long time ago, in that case my mistake. For more info: https://en.wikipedia.org/wiki/Personal_identity_number_(Sweden) https://en.wikipedia.org/wiki/Personal_identity_number_(Swed...
• a_c 10y ago
  One of the local bank in my city not only disable pasting, it disable typing altogether! It pops up a virtual keyboard and let client click on those virtual buttons. Since noticing that, not one single service from that bank was used anymore
• ozim 10y ago
  I am starting to be even bigger fan of 2FA. I had once bank account that prevented me from pasting pw first I made grease monkey script to remove this blocking then I removed my bank account from that bank.
• mattmaroon 10y ago
  I always assumed that the reason paste is disabled on change password forms is to prevent you from changing it to something you don't know. The whole point of making you type it twice is so that you get it right. If you type the password once and paste it twice, that is moot. Not that I necessarily agree with that notion (just make it easy for me to change it again) but that's the idea. I thought.
  • jobigoud 10y ago
    And that's exactly the point of OP. You can only "know" weak passwords. Disabling paste is assuming and forcing people to use weak passwords.
    • in_cahoots 10y ago
      What about the people who already have weak passwords, and accidentally misspell their dog's name or whatever? They're probably in the overwhelming majority compared to people using strong, complex passwords. Disabling paste here seems to be more of a convenience decision rather than a security one.
      • NolF 10y ago
        Isn't that what the "I forgot my password" feature is for?
• eloisius 10y ago
  TradeKing went full idiot and disabled entering your password by keyboard completely. They implemented an on-screen keyboard and there's no way to opt out. Their support forum is full of angry customers, people who can't use their screen readers anymore, etc. They argue [1] it's to protect their customers from key loggers. [1]: https://community.tradeking.com/forum/categories/suggestions/topics/664-new-tradeking-login-password-on-screen-keyboard-why/forum_posts https://community.tradeking.com/forum/categories/suggestions...
  • blazespin 10y ago
    Cause key loggers don't track mouse clicks. Lol. Two factor is their best bet.
    • jsudhams 10y ago
      VIrtual keyboard changes the character location every time it shows so unless u record click for log time or screen record it is difficult
      • takeda 10y ago
        Malware can still be capable to take screenshot of the screen. If it would log mouse clicks I would imagine it would at least take screenshot if not a video.
        • underwater 10y ago
          Knowing when to take a screenshot, uploading and storing it, and extracting the password is a lot more work than dumping a text file and grepping for bofa.com.
          • Retra 10y ago
            Psh, only if you're not also logging keys.
          • 10y ago
• Patrick_Devine 10y ago
  I just ran in to this using Google Drive for Mac yesterday. I assumed it was a bug and sent them feedback to fix it. I had no idea this was a thing.
• jonathankoren 10y ago
  Thank god I use "babababa" for all my passwords. No copy paste for me! I also defeat microphones with tape!
• pistle 10y ago
  Can someone school me in why we don't just throttle login attempts (each fail extends time to next attempt exponentially) and put an attempt cap that requires password reset?
• thaumasiotes 10y ago
  There is a piece of terrible, unwarranted analysis in this article: > But there’s one angle to this that helps explain the madness and it goes back to that earlier PayPal screen grab. This was of the change password page, not the login page. You can easily paste into the login page and in fact you can even paste into the original password field on the change password page, just not the new password field or the other field that confirms it. > The reason lies in the earlier message I showed from PayPal, in particular this part of the password criteria: > Use[] 8-20 characters > Ah, so because you’ve gone and put an arbitrary limit on the length of my password and taken away my ability to create a nice a 50 character random string, you’ve had to kill the paste function because otherwise I’d go around thinking I’ve got a 50 char password but it was actually truncated to 20 due to the maxlength attribute of the password field. Nice one guys, good work there Having spoken to no one about this, I'm still confident that Troy Hunt is full of crap. The reason to disallow copy-and-pasting into the new password field(s) is obviously the same as the reason you have a confirmation field in the first place: you want to make sure the user hasn't entered the password wrong, inadvertently locking themselves out of their own account. Allowing them to enter their password once and then paste it, typos and all, into the "confirm password" field completely defeats the purpose of having the confirm password field at all.
  • luuio 10y ago
    You know password managers don't make typo right?
  • Armaron 10y ago
    The typo is the added security. All joking aside, that's why you have password reset functionality. The reason I can't paste in most cases makes me choose another site. One that takes my security seriously. I'm the kind of user that wants to paste in a 40 character long password and store it in a manager that will allow me to forget all my passwords except one or two.
• Sami_Lehtinen 10y ago
  In Finland there are several banks which restrict passwords to 6-8 digits. Is that worse than disabling paste?
• takeda 10y ago
  Are there add-ons (particularly for Firefox) that disable these checks. This is quite annoying.
• jegoodwin3 10y ago
  Perhaps the companies involved have been told by their lawyers that choosing a password is a legal action, like an electronic signature, that must be performed by a human, letter by letter, to have certain legal ramifications. It is only stupidity if you assume the only purpose of a password (or a physical key) is security, and not also authorized entry. It may still be a poor engineering solution to the requirement (because engineers were told the solution, to asked to meet the requirement). But it is wrong to assume there is no reason for the requirement. You can't paste your legally binding electronic signature either, I'll warrant. I've had to type out my name plenty of times, in digital contracts, even though my browser is quite capable of auto-filling.
  • morgante 10y ago
    > Perhaps the companies involved have been told by their lawyers that choosing a password is a legal action, like an electronic signature That might be plausible if anyone actually thought that. E-contracts require typing out a signature, not a random phrase.
  • spullara 10y ago
    This is all made up nonsense. You can paste your signature, choose some random image to represent your signature, or even merely click to sign. Have you used Docusign? HelloSign? Document signing in Mac Preview? Please don't spread FUD.
    • jegoodwin3 10y ago
      The companies involved have specified a protocol for communicating your chosen password to them. Namely, the well known "spelling protocol" whereby you repeat your choice, letter by letter, to the other party. They have gone to some pains to enforce that protocol. The article advocates breaking the bank's protocol for your own convenience because you supposedly know more than the other party. In general, in life, this is bad advice. Please do not ask people to do things against the will of the other contracting party for their own convenience, without considering the risks of doing so.
• MRSallee 10y ago
  I doubt that the motivation for preventing paste in a "confirm password" context is to prevent workarounds to character limits. Why does the "confirm password" field exist anyway? It exists to remove the risk of input error. They want to avoid you locking into a mistyped password and not being able to recover. To this end, it makes some sense to prevent copy/paste, as a user may simply copy their mistyped password and paste it into the confirmation field. Especially risky if the input fields are obfuscated with placeholder characters (*). Not to argue that it's the right answer, it certainly makes more sense than a heavy-handed enforcement of character limits.
  • derekdahmer 10y ago
    I don't think thats right because browsers have always prevented password fields from being copied.
    • davidwhodge 10y ago
      Requiring input twice as input validation has a fair amount of use already, like with email addresses, so it doesn't seem super unreasonable to think that's a motivation for this limitation. Also, while it sounds silly, disabling copy doesn't mean a user can't type the PW somewhere else and paste it in. I've totally done that before and suspect it's not super uncommon.
  • GigabyteCoin 10y ago
    >Why does the "confirm password" field exist anyway? It exists to remove the risk of input error. They want to avoid you locking into a mistyped password and not being able to recover. It seems silly to force everybody to doubly enter their password, when I'd guess at most ~10% of people might enter an incorrect password on their first try at which point those unfortunate ones are only a few minutes away from a password reset... where they would be sure to get the password right that second time.
  • DavidSJ 10y ago
    I often use copy/paste to prevent typing errors. I save the password in some keychain software, then I copy/paste the password from that software into one of the password fields, and type it myself into the other.
• laurencei 10y ago
  I've recently seen this on credit card pages as well. I store my credit card data in 1Password - so I dont have to pull out my card each/every time I want to buy something online. Not been able to paste my credit card number into the field is a PITA.
• r0m4n0 10y ago
  I find it slightly annoying there were repeated hypotheticals that blamed the developer for designing these password pages. It's highly unlikely it was a rogue developer... Most of these companies probably use contract work and likely provide these stupid password requirements and use cases arbitrarily and weren't properly challenged...
• nikolay 10y ago
  Well, I go around these using the Dev Tools - even taught my kids how to go around such idiotisms!
• mjevans 10y ago
  The final inanity; what supports a compromised user device from simply submitting it's own copy of the form that it populated, or even transparently proxing the client and MitM on the compromised machine it's self so that it can change the submitted values?
• greedo 10y ago
  Backblaze is another company that does this, which is infuriating when you're entering your long private key into their client. CTRL-V doesn't work, but surprisingly, right-clicking and selecting paste does. I didn't realize this until I the second time I had to enter the key.
• rizwan 10y ago
  I get the meaning of the "Cobra Effect", but I'm not understanding it here w.r.t. disabling paste on password fields.
• ProfChronos 10y ago
  I recently read that Slack has combined salting and hashing with 2FA after their data breach in March 2015. But if I remember well, whenever you want to connect, you can get a "magic link" with an automatically generated password right in your mailbox and then copy-paste it in the app. Has someone tested if it's bullet proof?
• ivanche 10y ago
  I have a feeling that while Ctrl+V is prohibited, maybe Shift+Insert isn't...
  • 0xfeba 10y ago
    No, it counts as the paste event as well. But pasting to another text field in the application (or just the address bar), selecting and dragging the password to the field works, as it just counts as a "change" event, which would be very hard to disable without causing issues.
• Mrgir 10y ago
  Hopefully we'll all start using login methods like SQRL and alike and all this nonsense will be a thing of the past. Link for the interested: https://www.grc.com/sqrl/sqrl.htm https://www.grc.com/sqrl/sqrl.htm
• chrisweekly 10y ago
  Obligatory XKCD: https://xkcd.com/936/ https://xkcd.com/936/
• Fej 10y ago
  ...whatever. Use NoScript. Problem solved.
• vetrom 10y ago
  So what banks out there actually have password systems that let you use secure passwords, or maybe even real 2FA that aren't German banks with their TIN systems?
• foyk 10y ago
  and at this point, who isn't using a mobile device to enter passwords where potential shoulder surfers (human and camera) lurk? Without copy and paste, you have to what? Go into a bunker to type in passwords safely?