4 ms·
I never really tried to type my password and hit Send, so I never worried about this case. Hygiene has to be reshaped to understand how important master pw is c
by homakov 9y ago
I never really tried to type my password and hit Send, so I never worried about this case. Hygiene has to be reshaped to understand how important master pw is compared to all pw we used to type, like 123456.
- zwily 9y agoThe times I've seen people type passwords into Slack has usually been because they had the wrong field focused, and autopilot typed the password and hit Enter. (To be clear, this complaint applies to all schemes that rely on passwords derived from a master password.)
- GordonS 9y agoI've done it once before, with Keepass and Lync. I was working on several tasks at once, area bit of a frenzied pace. I had a few Lync chat Windows open. I copied my password from Keepass, alt-tabbed to what I thought was the browser, pasted and hit enter. Oops, wrong window... I've had people paste their passwords to me a couple of times over the years too.
- inimino 9y agoOne clever UI way around this would be to not use Enter in the master password field. Instead use something on the homerow like "jkl" to end every password. Then the input field just accepts whenever /.*jkl/ matches. This mostly solves the "wrong focus" problem because hitting Enter is no longer part of the muscle memory. Of course you could still enter it into a shared Google doc or something else that discloses without Enter, so it's only a partial solution.