16 ms·
Of course it reduces security. It makes you resort to either 1.) typing it out manually while you can't see if you made a mistake 2.) using developer tools to
by artursapek 9y ago
Of course it reduces security. It makes you resort to either
1.) typing it out manually while you can't see if you made a mistake
2.) using developer tools to set the 'value' attribute directly
"SPP" discourages use of a password manager. End of story. I also see this pattern used on banking websites for inputs like an account number. This drives me crazy as well for the same reason. The computer can get it right more reliably than my eyes and fingers.
Whenever I see a website that blocks paste I immediately assume it's built by incompetent people and trust it with as little as possible.
- sowbug 9y agoI also worry when a site doesn't work with autocomplete. It's rare these days that the developers have actively tried to prevent it from working, but more common that an unnecessarily intricate sign-in flow makes the existence of the password field unrecognizable to the browser. This makes me wonder about the personal security practices of the team that built it -- it's unlikely they typed strong passphrases hundreds of times a day during development -- and whether a secure site could come from such a team.
- Tobani 9y agoThere are a couple of reasons to actively prevent autofill passwords. The only one I have seen for login autofill prevention is when the password is actually a generated token (ala yubikey,etc) and a password manager won't do the right thing by default. There are regulatory bodies that require regular challenge of user identity for approving items as sort of a signature mechanism. This is another time where active thwarting the password manager makes sense. Whether or not the regulation makes sense is an entirely different issue.
- sowbug 9y agoThose are good reasons, and I appreciate when the attribute is used properly in these cases. It's annoying to have to say "no, don't remember this updated password" to my browser every single time I visit certain sites that ask for OTPs that my browser wants to autofill. In the token case, I wonder whether they should have been password fields to begin with. Replacing a 6-digit OTP with asterisks is of questionable benefit, because the shoulder-surfer it thwarts can't reuse the OTP and is really unlikely to swipe it and use it before you do.
- 0xfeba 9y agoYou can also paste it somewhere on the browser or site, then select and drag it to the password field in a lot of cases.
- thesuitonym 9y agoOther signs that a site was built by incompetent developers (Or had too much management interference--Devs aren't always to blame!): Only works with Internet Explorer Doesn't work with Internet Explorer Password must have one of 4-10 special characters, but not other special characters. (e.g.: Must contain !, @, ^, &, or parentheses, but not ;, ", etc) Passwords have no requirements Right-click is disabled Video plays as soon as the site loads Share buttons that use javascript to follow the viewport Share buttons that pop up over every single image "Want to see more" when you move the mouse to the top of the screen (Or reach the bottom of the page) (or as soon as the page loads) Slideshows of any sort
- reacweb 9y agoI agree with all your points except slideshows. Why so much hate against slideshows ?
- badosu 9y agoI don't have a problem with slideshows, but a reason is that, in the UX perspective, elements that animate recurringly with previously hidden content (and possibly links) is confusing and not actually used, and then when you find something you want to check you have to use the slideshow pagination, which is cumbersome. Better to properly display the points of interest.
- devopsproject 9y agoThey are used by people who need to turn what should be 3 bullet points into a slow "presentation".
- Tactic 9y agoI don't like them because they make it difficult to copy and paste the whole of the content.
- hedora 9y agoI was talking to one of the Facebook cofounders years ago, and he put it better than I could (he wasn't talking about slideshows specifically). I don't have an exact quote but it went something like this: We don't optimize for impressions per session. Instead we optimize for the number of things a user does in a fixed amount of time, (or per session). The former is a poor proxy for the latter, and you can increase impressions by adding useless click through pages that ultimately drive away users and destroy your business in the long term. (In the short term, these things make your metrics look good.) I bring this up because slideshows are a great way to artificially boost impressions.
- xname2 9y agoThe end result of "discourages use of a password manager" is definitely this for normal users: use the same password for all website logins. How is this a good thing?
- ErrantX 9y agoIt's interesting that a lot of us are assuming that pasting encourages the use of password managers. However; I worry that this is a very BIG assumption. Even in my IT-literate circles password management usage is low. In my non-IT circles it is non-existent, and not because of SPP particularly; I suspect SPP (which I agree is silly) derived from an understanding that allowing an average person to paste passwords meant they stored them in passwords.txt on their desktop. Naturally the population here is technical so it can be hard to see that as a common and sensible thought process. But never underestimate the capacity of the average person (who's IT capability you and I don't represent) to make mistakes like this and never see the problem/risk. It's odd that the article explicitly mentions this near the start but then doesn't address it in the Justifications section.
- furyofantares 9y ago> I suspect SPP (which I agree is silly) derived from an understanding that allowing an average person to paste passwords meant they stored them in passwords.txt on their desktop That's a significantly better practice than using the same easy-to-type password on every site, isn't it?
- pmontra 9y agoI assume that those people still use a passwords.txt and type the passwords in it, or they use only one password for all the sites. So SPP doesn't change anything for them but it makes switching them to a password manager more difficult.
- chefandy 9y agoWhy are you worried? Regardless of whether avoiding SPP 'encourages,' that is, actively advocates for the use of password managers, we can agree that implementing SPP 'discourages' the use of password managers, right? So is there some risk I'm not seeing in 'enabling but not overtly advocating for' the use of password managers?
- city41 9y agoI don't think the assumption is pasting encourages password managers. The assumption is not allowing pasting discourages password managers.
- jmkni 9y agoI use a password manager to generate long, complex passwords for every service I use (as complex as the service will allow). For sites that disable pasting, I have developed quite a skill at copying the password character by character from my PM into the password field. I'm even starting to remember a couple of them. Incredibly frustrating.
- stanmancan 9y agoI just had the joy of entering in a PM generated 64 character password into a new Android phone during the set up process; fun!
- pmontra 9y agoSometimes I open the developer tools and paste the password in the value of the input element there. It usually works.
- jermaustin1 9y agoIf you can remember it that means you need to change it! I refuse to look at any of my generated passwords. For the services that wont let me paste in, I have a macro that will type whats on my clipboard. Just a simple auto IT script with a WAIT (so I can make sure I focus on the input box) and SEND. My password manager also clears the clipboard if it is equal to the last password copied after a wile (I've never timed it).
- SamBam 9y ago> If you can remember it that means you need to change it! I refuse to look at any of my generated passwords. I'm trying to understand the reasoning for this. Are you dealing with very sensitive information that you have a real reason to fear the rubber-hose cryptanalysis method?
- syncsynchalt 9y agoMore because you'll develop a resistance to changing the password, since you'll have to start over on memorizing the new one.
- bradleyjg 9y ago>> 1.) typing it out manually while you can't see if you made a mistake This is my pet peeve. Password fields should not be obfuscated by default. It should be a toggle that is off on page load. Shoulder surfing is a corner case.
- macintux 9y agoCameras are everywhere in public spaces, and most people wouldn't notice a password field wasn't obfuscated until they've already started typing. Defaulting to obfuscated seems the only sensible option.
- dkonofalski 9y agoNo way. The number of reported cases of passwords being stolen simply by physical proximity is enough to make this a sensible default. I agree that there should be an option to show the password as you're typing or, at a minimum, once you're done typing (less secure) but making that the default is unreasonable.
- beached_whale 9y agoAlso, a password manager that is built into the browser can give hints(sometimes subtle) that the site isn't who is says it is because the password/user id is tied to the domain
- dawnerd 9y agoOddly enough namecheap prevents pasting into their 2fa code input. I tried to tell them that a lot of us get sms messages on your desktop thanks to apple messages.
- frik 9y agoSo many forms also ask to enter the email address twice. I mean I can understand asking to type in the password twice, but email address - seriously!?
- vageli 9y agoThat restriction I can understand, though I think passwords should not have to be typed twice. If you enter the password incorrectly, you can always reset it after the fact. But if you enter the incorrect email address (and subsequently forget the password), it will be harder to access your account since you presumably do not have access to the (erroneous) email used for registration.
- eikenberry 9y ago3) use an auto-typing tool to type in your password for you eg. echo "type password" | xdotool -
- alexbeloi 9y agoIf you want to see incompetence, the California DMV doesn't allow copy/paste AND it asks for not two, not three, but SIX personal security questions. Oh, and if you forget your login/pass/security-answers, don't worry, you can just re-register your account with the same username as before, with all new password, security questions and answers.
- JauntyHatAngle 9y ago>it asks for not two, not three, but SIX personal security questions. As in... every login it wants you to answer all six of your questions? That's barmy.
- alexbeloi 9y agoNo, part of the registration, for password recovery
- Nition 9y agoMaybe it's time we stop labelling password reset links as "Forgot my password." Implies you're supposed to have it only in your head.