4 ms·

I wish they'd also added: Verifiers SHOULD NOT prevent users from pasting secrets from the keyboard.

• sleavey 10y ago
  I've seen banks do this, and I agree it's incredibly annoying. KeePassX's autotype function bypasses copy-and-paste restrictions, since it emulates the keyboard as it types your password.
  • nommm-nommm 10y ago
    Pressing F12 and modifying the DOM usually works as well.
  • paulddraper 10y ago
    Next is custom screen keyboards made with <canvas>
    • chikei 10y ago
      You're allow only to input using their custom screen keyboard AND randomize the position of each key. Banks: this is to prevent attacker use keylogger or mouse position logger. I was like, are you fucking serious ?
      • rolandog 10y ago
        Shh... don't give them any ideas.
• jmah 10y ago
  Usually this is accomplished by blocking the keyboard shortcut; pasting via right-click menu typically works.
• gmiller123456 10y ago
  Actually, no. This is about "memorized secrets", not "secrets stored somewhere else". That's not to say that secrets stored somewhere else can't be better than passwords in certain situations, they're just a different type of authentication. A password is "something you know", and stored password is "something you have". Some systems are required to use different types of authentication, one thing you know, one thing you have, and one thing about you (e.g. fingerprint/retina scan). Allowing a copy and paste from a different source violates the "something you know" requirement.