2 ms·

> Just disregard the segment of your users who don't use password managers? No, I recognize that most users probably don't use password managers. But I'm not c

> Just disregard the segment of your users who don't use password managers? No, I recognize that most users probably don't use password managers. But I'm not convinced that disabling pasting helps much. For one thing, I don't actually think it's that common for someone to copy a mistyped password. Browsers disable copying from password fields, so they would have to type it in a third place and copy it into the fields from there. Most users are not sophisticated enough to do that. > Also, if you're someone who uses a password manager, does disabling pasting really make you less secure? It directly encourages people to use less secure passwords. If I try to manually retype a 50 character password myself, I'm very likely to make an error. This isn't theoretical—I've often purposefully lowered the complexity of passwords for sites with these kind of arbitrary restrictions. It's too bad 1Password doesn't have an auto-type feature.

level3 10y ago
That's a fair point that in general, password fields aren't copyable. So I do think that retyping passwords has value, but disabling pasting may have questionable value. (In my experience, disabling pasting on email confirmation fields does reduce the rate of error there, since lots of people copy-paste)
ry_ry 10y ago
You can get/set HTMLInputElement.value on [type="password"] anyway so if you wanted to shim the PW field copy/paste functionality back, you could just create a bookmarklet or something. Edit, threw an example together. Ignore the horrible code ;P Http://jsfiddle.net/6gc2d6hb Type in one of the PW fields then double-click it. Doesn't overwrite populated PW fields.
- happyslobro 10y ago
  And once again, we find ourselves inspecting elements to fix someone's brilliant idea.
  - ry_ry 10y ago
    True enough - the open nature of the client makes a joke of so many do-called security measures implemented there.
- nommm-nommm 10y ago
  I just open up firebug and edit the DOM to add value='mydesiredpassword' to the password field(s).

level3 10y ago

That's a fair point that in general, password fields aren't copyable. So I do think that retyping passwords has value, but disabling pasting may have questionable value. (In my experience, disabling pasting on email confirmation fields does reduce the rate of error there, since lots of people copy-paste)

ry_ry 10y ago

You can get/set HTMLInputElement.value on [type="password"] anyway so if you wanted to shim the PW field copy/paste functionality back, you could just create a bookmarklet or something. Edit, threw an example together. Ignore the horrible code ;P Http://jsfiddle.net/6gc2d6hb Type in one of the PW fields then double-click it. Doesn't overwrite populated PW fields.

happyslobro 10y ago
And once again, we find ourselves inspecting elements to fix someone's brilliant idea.
- ry_ry 10y ago
  True enough - the open nature of the client makes a joke of so many do-called security measures implemented there.
nommm-nommm 10y ago
I just open up firebug and edit the DOM to add value='mydesiredpassword' to the password field(s).