5 ms·

I use a password manager to generate long, complex passwords for every service I use (as complex as the service will allow). For sites that disable pasting, I

by jmkni 9y ago

I use a password manager to generate long, complex passwords for every service I use (as complex as the service will allow). For sites that disable pasting, I have developed quite a skill at copying the password character by character from my PM into the password field. I'm even starting to remember a couple of them. Incredibly frustrating.

stanmancan 9y ago
I just had the joy of entering in a PM generated 64 character password into a new Android phone during the set up process; fun!
pmontra 9y ago
Sometimes I open the developer tools and paste the password in the value of the input element there. It usually works.
jermaustin1 9y ago
If you can remember it that means you need to change it! I refuse to look at any of my generated passwords. For the services that wont let me paste in, I have a macro that will type whats on my clipboard. Just a simple auto IT script with a WAIT (so I can make sure I focus on the input box) and SEND. My password manager also clears the clipboard if it is equal to the last password copied after a wile (I've never timed it).
- SamBam 9y ago
  > If you can remember it that means you need to change it! I refuse to look at any of my generated passwords. I'm trying to understand the reasoning for this. Are you dealing with very sensitive information that you have a real reason to fear the rubber-hose cryptanalysis method?
  - syncsynchalt 9y ago
    More because you'll develop a resistance to changing the password, since you'll have to start over on memorizing the new one.
    - moosingin3space 9y ago
      This is a good point, and part of the problem with the way the average computer user (and far too many above-average users) treat their passwords.
    - dainichi 9y ago
      AFAIK the benefit of changing passwords regularly is highly debatable anyway. If so, I think "Don't change it, since you would have to memorize the new one" is more logical advice.
  - jermaustin1 9y ago
    As a consultant, I have been given access to a lot of passwords for clients. From corporate bank accounts to production servers at government agencies. So they are very sensitive, and when my contract is up, I delete the password folder for that client. I started doing that with clients, then eventually ended up continuing it to my personal passwords as well.
    - SamBam 9y ago
      You talked about not even looking at generated passwords, which is different from client's passwords. That's the part I didn't understand. Although, honestly, the other part seems more bizarre. Gov't agencies and other clients are just giving you their sensitive passwords, and trusting you to delete them after the project, at your leisure? How is that not terrible security? Revoking a consultant's security needs to be in the hands of the employers.
      - jermaustin1 9y ago
        I'm pretty sure the passwords I'm given are generated. I wouldn't really know as they shared the passwords in a file with me that I never looked at them. I'm sure they cleaned up accounts on their end, but I would rather do some due diligence on my end as well. I don't know their processes and procedures. But why even know your own passwords, what is the point? If I can double click from my manager and paste it into my password field and never have to worry about knowing anything, I'm much happier and safer.
  - mark-r 9y ago
    For those not familiar with the rubber-hose method: https://xkcd.com/538/ https://xkcd.com/538/
    - SamBam 9y ago
      Personally, I always thought the phrase ought to be "brutish-force cracking," like "brute force", but that's just me...
SAI_Peregrinus 9y ago
Use KeePass's auto-type feature. I'm not familiar with other password managers, but for KeePass it emulates a keyboard, and works on sites that disable pasting.
- jesusth1 9y ago
  Wow, I've been using KeePass like a monkey then, thanks for this.
deleted 9y ago
[deleted]
pwg 9y ago
> For sites that disable pasting, For Firefox, setting the "dom.event.clipboardevents.enabled" about:config option to false prevents clipboard paste events from reaching javascript. No more blocked pasting after you toggle that option, even if the website attempts to do so.
- krallja 9y ago
  I've seen sites that disable the input whenever the ctrl key is held down.
  - pferde 9y ago
    Use "Paste" from right click menu. Configure your environment to use a different paste keyboard combo. Use the old X11 clipboard with middle button paste.
- teekert 9y ago
  Came here to say this, this should be the top post.
eridius 9y ago
I write an Alfred (https://www.alfredapp.com https://www.alfredapp.com) workflow that sends keystroke events using AppleScript for arbitrary strings, specifically to work around SPP. The AppleScript in question is very simple, it just looks like on alfred_script(q) tell application "System Events" to keystroke q end alfred_script

by jmkni 9y ago

stanmancan 9y ago

I just had the joy of entering in a PM generated 64 character password into a new Android phone during the set up process; fun!

pmontra 9y ago

Sometimes I open the developer tools and paste the password in the value of the input element there. It usually works.

jermaustin1 9y ago

If you can remember it that means you need to change it! I refuse to look at any of my generated passwords. For the services that wont let me paste in, I have a macro that will type whats on my clipboard. Just a simple auto IT script with a WAIT (so I can make sure I focus on the input box) and SEND. My password manager also clears the clipboard if it is equal to the last password copied after a wile (I've never timed it).

SamBam 9y ago
> If you can remember it that means you need to change it! I refuse to look at any of my generated passwords. I'm trying to understand the reasoning for this. Are you dealing with very sensitive information that you have a real reason to fear the rubber-hose cryptanalysis method?
- syncsynchalt 9y ago
  More because you'll develop a resistance to changing the password, since you'll have to start over on memorizing the new one.
  - moosingin3space 9y ago
    This is a good point, and part of the problem with the way the average computer user (and far too many above-average users) treat their passwords.
  - dainichi 9y ago
    AFAIK the benefit of changing passwords regularly is highly debatable anyway. If so, I think "Don't change it, since you would have to memorize the new one" is more logical advice.
- jermaustin1 9y ago
  As a consultant, I have been given access to a lot of passwords for clients. From corporate bank accounts to production servers at government agencies. So they are very sensitive, and when my contract is up, I delete the password folder for that client. I started doing that with clients, then eventually ended up continuing it to my personal passwords as well.
  - SamBam 9y ago
    You talked about not even looking at generated passwords, which is different from client's passwords. That's the part I didn't understand. Although, honestly, the other part seems more bizarre. Gov't agencies and other clients are just giving you their sensitive passwords, and trusting you to delete them after the project, at your leisure? How is that not terrible security? Revoking a consultant's security needs to be in the hands of the employers.
    - jermaustin1 9y ago
      I'm pretty sure the passwords I'm given are generated. I wouldn't really know as they shared the passwords in a file with me that I never looked at them. I'm sure they cleaned up accounts on their end, but I would rather do some due diligence on my end as well. I don't know their processes and procedures. But why even know your own passwords, what is the point? If I can double click from my manager and paste it into my password field and never have to worry about knowing anything, I'm much happier and safer.
- mark-r 9y ago
  For those not familiar with the rubber-hose method: https://xkcd.com/538/ https://xkcd.com/538/
  - SamBam 9y ago
    Personally, I always thought the phrase ought to be "brutish-force cracking," like "brute force", but that's just me...

SAI_Peregrinus 9y ago

Use KeePass's auto-type feature. I'm not familiar with other password managers, but for KeePass it emulates a keyboard, and works on sites that disable pasting.

jesusth1 9y ago
Wow, I've been using KeePass like a monkey then, thanks for this.

deleted 9y ago

[deleted]

pwg 9y ago

> For sites that disable pasting, For Firefox, setting the "dom.event.clipboardevents.enabled" about:config option to false prevents clipboard paste events from reaching javascript. No more blocked pasting after you toggle that option, even if the website attempts to do so.

krallja 9y ago
I've seen sites that disable the input whenever the ctrl key is held down.
- pferde 9y ago
  Use "Paste" from right click menu. Configure your environment to use a different paste keyboard combo. Use the old X11 clipboard with middle button paste.
teekert 9y ago
Came here to say this, this should be the top post.

eridius 9y ago

I write an Alfred (https://www.alfredapp.com https://www.alfredapp.com) workflow that sends keystroke events using AppleScript for arbitrary strings, specifically to work around SPP. The AppleScript in question is very simple, it just looks like on alfred_script(q) tell application "System Events" to keystroke q end alfred_script