4 ms·

Not that I think it's a good reason, but I think the rationale behind disabling paste is to prevent users from implementing their own "password managers" via a

Not that I think it's a good reason, but I think the rationale behind disabling paste is to prevent users from implementing their own "password managers" via a .txt file full of passwords on their Desktop (more common than you'd think).

morgante 10y ago
Why though? A .txt file on the desktop is actually probably a lot more secure than using the same shitty password on every site.
- im3w1l 10y ago
  A friend may get tempted to sneak a peek.
  - kintamanimatt 10y ago
    That's pretty tough with FDE, proper permissions on the text file, an ephemeral guest account for the times someone wants to use your computer, and religiously locking the screen when AFK.
  - robbbbbbbbb 10y ago
    Your friend could just as easily install a keylogger and get everything anyway.
    - im3w1l 10y ago
      Theorethically yes, but there is a much bigger psychological barrier to doing that.
  - ygra 10y ago
    You may want to get more trustworthy friends ...
onion2k 10y ago
I'd rather a user has a strong password that they paste from a file than a weak password they can type easily. If their machine is hacked then it's game over anyway. At least using a txt file of strong passwords means their account is secure if the online service is compromised.
waterhouse 10y ago
I have a method of generating passwords from a cryptographic hash of a secret key and the name of a service. This has been defeated by several services that forbid me from using the resulting passwords, either because of their special-character requirements or password lengths (after encountering some of this, I prefix the output with "A1a" and cut it off at 16 characters, but I've used services where even that isn't good enough), or because they want me to change my password every N days and don't allow me to reuse passwords. I submit, I give up, you win. There's a file called "plaintext-passwords.txt" in my home directory. I keep the account information for these services in there. I've thought of keeping it encrypted, but if they don't want my account to be secure, why should I? Anyway, if I had to type these passwords in rather than paste them, that would not stop me. All it might do is incentivize me to make them shorter.

morgante 10y ago

Why though? A .txt file on the desktop is actually probably a lot more secure than using the same shitty password on every site.

im3w1l 10y ago
A friend may get tempted to sneak a peek.
- kintamanimatt 10y ago
  That's pretty tough with FDE, proper permissions on the text file, an ephemeral guest account for the times someone wants to use your computer, and religiously locking the screen when AFK.
- robbbbbbbbb 10y ago
  Your friend could just as easily install a keylogger and get everything anyway.
  - im3w1l 10y ago
    Theorethically yes, but there is a much bigger psychological barrier to doing that.
- ygra 10y ago
  You may want to get more trustworthy friends ...

onion2k 10y ago

I'd rather a user has a strong password that they paste from a file than a weak password they can type easily. If their machine is hacked then it's game over anyway. At least using a txt file of strong passwords means their account is secure if the online service is compromised.

waterhouse 10y ago

I have a method of generating passwords from a cryptographic hash of a secret key and the name of a service. This has been defeated by several services that forbid me from using the resulting passwords, either because of their special-character requirements or password lengths (after encountering some of this, I prefix the output with "A1a" and cut it off at 16 characters, but I've used services where even that isn't good enough), or because they want me to change my password every N days and don't allow me to reuse passwords. I submit, I give up, you win. There's a file called "plaintext-passwords.txt" in my home directory. I keep the account information for these services in there. I've thought of keeping it encrypted, but if they don't want my account to be secure, why should I? Anyway, if I had to type these passwords in rather than paste them, that would not stop me. All it might do is incentivize me to make them shorter.