8 ms·

I wonder how we force change with individual companies? Today I had to sign up for a UPS account. The password length was set to max 27 characters, and the form

I wonder how we force change with individual companies? Today I had to sign up for a UPS account. The password length was set to max 27 characters, and the form had disabled paste in the password field. Who do we lobby to get them to fail their next PCI-DSS compliance test?

swiley 9y ago
Well for that you can probably turn off JavaScript or use the web inspector to enable paste.
- peteretep 9y ago
  I can. My wife, who I've taught to use a password manager, probably can't. And neither of these excuses a 27 character limit that strongly suggests my password is being stored unencrypted somewhere.
  - keteb 9y ago
    Not sure how that suggests that at all. User inputs have some sort of cap (don't want someone using a 2GB string as their password). So naturally there's a conversation at some point about "what's our maximum password size". If that conversation starts off at 1000 characters you're fine, but more often then not it looks more like: "Make the requirement 8-12 characters" "12 is too short" "fine make it longer, like" "Ok" [18 char implementation] "Hey, Bob in accounting says he uses 20 char passwords" "Fine, bump it by another 50%" [27 char implementation] [no further internal complaints] [Specs never updated or reviewed again]
  - vacri 9y ago
    use X windows - middle-click-to-paste usually gets around these 'no paste here' thingies. :)
  - tracker1 9y ago
    It may well be encrypted, but not hashed...
- Piskvorrr 9y ago
  And then the rest of the login stops working (and the character limit might be enforced again serverside, or worse, silently truncated). Plus, go try that on a smartphone.
captn3m0 9y ago
PCI-DSS still recommends password expiry, rotation, and complexity rules. If you undergo certification, send a mail to them and let them know that you prefer the NIST guidelines. Might happen in the next version release.
saurik 9y ago
That is enough characters that if you restrict yourself to the ~95 normal printable characters you can obtain around 175 bits worth of password (as in, more than enough to store a SHA1 sum). Is that really not enough entropy for your use case?
- peteretep 9y ago
  A constraint on password length is often suggestive that the password is not being stored securely.
  - user5994461 9y ago
    That's simply not true.
    - jessaustin 9y ago
      Yes it totally is true. Hashes are a standard length, and you can feed any length passphrase into the hash algorithm. It wouldn't surprise me to see passphrases limited to e.g. 256 chars anyway, but 27 smells very bad. What system limitation leads to this particular number? It smells like a DB column width to me.
      - user5994461 9y ago
        Just because there is a limitation on password length doesn't imply they store the password in clear text.
        nthcolumn 9y ago
        He never said anything about 'clear text' you did and yes that is usually how it is with this 'tell'. It might be some other weakness. Smells like homebrew security. Nice. They are doing it wrong and the wrong shows. That is definitely going in my initial survey.
        peteretep 9y ago
hedora 9y ago
Even worse than disable paste, I've noticed a lot of iPhone apps now require you to set a non-pasteable 4-6 digit pin to login (sometimes this is required to use the app at all, sometimes only if you enable touch id). At least one bank says the pin is "for this device" but then accepts it on new iOS devices too (without ever prompting for the "real" password on the new device).
- bigiain 9y ago
  We've got a few apps where that's been a customer requirement. The thinking is that 1) there are enough people who either do not use a pin/fingerprint to secure their phone and 2) lots of people let other people use their phone (especially parents with kids) - sometimes the argument that securing the PII in the app is a reasonable choice. (I occasionally worry that my phone's bitcoin wallet does not do this. There is occasionally a large enough balance in there that I'd really like to have to touchid to open it and transfer those bitcoin out... Not quite worried enough to investigate whether other wallet options do it, but sometimes I hand my phone to someone to show them a pic and think "Do I _really_ know this person well enough to trust they won't poke around my phone and try to distract me enough to swipe some bitcoin???")
thangngoc89 9y ago
Someone made an Chrome extension to enable password pasting again. Don't Fuck With Paste: https://chrome.google.com/webstore/detail/dont-fuck-with-paste/nkgllhigpcljnhoakjkgaieabnkmgdkb?utm_source=chrome-app-launcher-info-dialog https://chrome.google.com/webstore/detail/dont-fuck-with-pas...
- Aaronn 9y ago
  Also available on Firefox: https://addons.mozilla.org/en-US/firefox/addon/don-t-fuck-with-paste/?src=userprofile https://addons.mozilla.org/en-US/firefox/addon/don-t-fuck-wi...
- gruez 9y ago
  For Firefox users: https://developer.mozilla.org/en-US/docs/Mozilla/Preferences/Preference_reference/dom.event.clipboardevents.enabled https://developer.mozilla.org/en-US/docs/Mozilla/Preferences...
- tracker1 9y ago
  Thanks... :-) I hate that... I mean, pwd managers and paste are more secure than having to type them in.. not to mention, less prone to mistakes.
- bigiain 9y ago
  And now we've moved the problem from "I used a weak password for $site because I couldn't paste it from my password manager" to "I've got an extension in my browser from some internet random that manipulates every form field including the password field on every webpage I visit"... (And yeah, the "internet random" here has a github repo with the code, and the file that does this is an easily auditable 16 lines of javascript, so props to him for that. But it's still got the recently exploited attack vector that he or an attacker who takes over his account could push malicious updates to the extension, like the webdev extension from earlier this week...)
- joshschreuder 9y ago
  I've used this extension before, just a note that it will break legitimate onpaste events, for example websites that let you paste an image in, like Imgur or Twitter https://github.com/jswanner/DontFuckWithPaste/issues/14 https://github.com/jswanner/DontFuckWithPaste/issues/14
24gttghh 9y ago
KeePass uses an auto-type feature; wouldn't that simulate individual key presses, and defeat anti-paste mechanisms?
- duxup 9y ago
  I find that on some sites if I click in the username field and alt tab to keepass or any other function I'm suddenly not in the txt field on the site... thus I can't trigger auto type at times.
  - mohn 9y ago
    It's unfortunate that this workaround is needed, but in KeePass you can set a custom keystroke sequence to define what actions are performed during auto-type. Right click > "Edit/view entry" > "Auto-Type" tab > Override default sequence: I then entered {DELAY 3000}{PASSWORD} Now I can log in to a full screen game that doesn't allow pasting (I type in the username by hand first). If I'm alt-tabbed out of the game with KeePass in focus, the three second delay is enough time to go from triggering auto-type to restoring the full screen game window and clicking on the password field to give it focus. I was unable to trigger KeePass autotype with the game already full screen. If the account you're trying to log in to also has a long random username that needs to be auto-typed, you'll probably want a sequence like "{DELAY 3000}{USERNAME}{TAB}{PASSWORD}". Or, if the form doesn't allow you to tab from the username to the password field, you could use "{DELAY 3000}{USERNAME}{DELAY 3000}{PASSWORD}" and you can click on the password field during the second delay.
    - duxup 9y ago
      Thank you!
loginx 9y ago
You think that's bad? My damn BANK has the following password policy for online banking: The password you create here can be used to access Online, Mobile and Telephone Banking. All passwords must be six characters in length. Special characters (eg. *, %, $, etc) will not be accepted.
- blacksmith_tb 9y ago
  Banks are some of the worst - though oddly in many cases I've seen them support much more complex usernames than passwords. If you use a password manager you can generate large, random usernames to go with your tiny, weak password, potentially.
- sleepybrett 9y ago
  get a new bank, then tell them why.
  - Spivak 9y ago
    I'm sure they will be heartbroken.
  - forgotAgain 9y ago
    Send it in a certified letter. Address it to the CEO and send certified CC's to the FDIC, CIO, and a reporter for a local or national tech newspaper column. It may sound archaic but you have to raise the visibility if you're concerned about changing the banks behavior.
    - zild3d 9y ago
      People just tweet @ceo or @company these days, same effect

swiley 9y ago

Well for that you can probably turn off JavaScript or use the web inspector to enable paste.

peteretep 9y ago
I can. My wife, who I've taught to use a password manager, probably can't. And neither of these excuses a 27 character limit that strongly suggests my password is being stored unencrypted somewhere.
- keteb 9y ago
  Not sure how that suggests that at all. User inputs have some sort of cap (don't want someone using a 2GB string as their password). So naturally there's a conversation at some point about "what's our maximum password size". If that conversation starts off at 1000 characters you're fine, but more often then not it looks more like: "Make the requirement 8-12 characters" "12 is too short" "fine make it longer, like" "Ok" [18 char implementation] "Hey, Bob in accounting says he uses 20 char passwords" "Fine, bump it by another 50%" [27 char implementation] [no further internal complaints] [Specs never updated or reviewed again]
- vacri 9y ago
  use X windows - middle-click-to-paste usually gets around these 'no paste here' thingies. :)
- tracker1 9y ago
  It may well be encrypted, but not hashed...
Piskvorrr 9y ago
And then the rest of the login stops working (and the character limit might be enforced again serverside, or worse, silently truncated). Plus, go try that on a smartphone.

captn3m0 9y ago

PCI-DSS still recommends password expiry, rotation, and complexity rules. If you undergo certification, send a mail to them and let them know that you prefer the NIST guidelines. Might happen in the next version release.

saurik 9y ago

That is enough characters that if you restrict yourself to the ~95 normal printable characters you can obtain around 175 bits worth of password (as in, more than enough to store a SHA1 sum). Is that really not enough entropy for your use case?

peteretep 9y ago
A constraint on password length is often suggestive that the password is not being stored securely.
- user5994461 9y ago
  That's simply not true.
  - jessaustin 9y ago
    Yes it totally is true. Hashes are a standard length, and you can feed any length passphrase into the hash algorithm. It wouldn't surprise me to see passphrases limited to e.g. 256 chars anyway, but 27 smells very bad. What system limitation leads to this particular number? It smells like a DB column width to me.
    - user5994461 9y ago
      Just because there is a limitation on password length doesn't imply they store the password in clear text.
      - nthcolumn 9y ago
        He never said anything about 'clear text' you did and yes that is usually how it is with this 'tell'. It might be some other weakness. Smells like homebrew security. Nice. They are doing it wrong and the wrong shows. That is definitely going in my initial survey.
      - peteretep 9y ago

hedora 9y ago

Even worse than disable paste, I've noticed a lot of iPhone apps now require you to set a non-pasteable 4-6 digit pin to login (sometimes this is required to use the app at all, sometimes only if you enable touch id). At least one bank says the pin is "for this device" but then accepts it on new iOS devices too (without ever prompting for the "real" password on the new device).

bigiain 9y ago
We've got a few apps where that's been a customer requirement. The thinking is that 1) there are enough people who either do not use a pin/fingerprint to secure their phone and 2) lots of people let other people use their phone (especially parents with kids) - sometimes the argument that securing the PII in the app is a reasonable choice. (I occasionally worry that my phone's bitcoin wallet does not do this. There is occasionally a large enough balance in there that I'd really like to have to touchid to open it and transfer those bitcoin out... Not quite worried enough to investigate whether other wallet options do it, but sometimes I hand my phone to someone to show them a pic and think "Do I _really_ know this person well enough to trust they won't poke around my phone and try to distract me enough to swipe some bitcoin???")

thangngoc89 9y ago

Someone made an Chrome extension to enable password pasting again. Don't Fuck With Paste: https://chrome.google.com/webstore/detail/dont-fuck-with-paste/nkgllhigpcljnhoakjkgaieabnkmgdkb?utm_source=chrome-app-launcher-info-dialog https://chrome.google.com/webstore/detail/dont-fuck-with-pas...

Aaronn 9y ago
Also available on Firefox: https://addons.mozilla.org/en-US/firefox/addon/don-t-fuck-with-paste/?src=userprofile https://addons.mozilla.org/en-US/firefox/addon/don-t-fuck-wi...
gruez 9y ago
For Firefox users: https://developer.mozilla.org/en-US/docs/Mozilla/Preferences/Preference_reference/dom.event.clipboardevents.enabled https://developer.mozilla.org/en-US/docs/Mozilla/Preferences...
tracker1 9y ago
Thanks... :-) I hate that... I mean, pwd managers and paste are more secure than having to type them in.. not to mention, less prone to mistakes.
bigiain 9y ago
And now we've moved the problem from "I used a weak password for $site because I couldn't paste it from my password manager" to "I've got an extension in my browser from some internet random that manipulates every form field including the password field on every webpage I visit"... (And yeah, the "internet random" here has a github repo with the code, and the file that does this is an easily auditable 16 lines of javascript, so props to him for that. But it's still got the recently exploited attack vector that he or an attacker who takes over his account could push malicious updates to the extension, like the webdev extension from earlier this week...)
joshschreuder 9y ago
I've used this extension before, just a note that it will break legitimate onpaste events, for example websites that let you paste an image in, like Imgur or Twitter https://github.com/jswanner/DontFuckWithPaste/issues/14 https://github.com/jswanner/DontFuckWithPaste/issues/14

24gttghh 9y ago

KeePass uses an auto-type feature; wouldn't that simulate individual key presses, and defeat anti-paste mechanisms?

duxup 9y ago
I find that on some sites if I click in the username field and alt tab to keepass or any other function I'm suddenly not in the txt field on the site... thus I can't trigger auto type at times.
- mohn 9y ago
  It's unfortunate that this workaround is needed, but in KeePass you can set a custom keystroke sequence to define what actions are performed during auto-type. Right click > "Edit/view entry" > "Auto-Type" tab > Override default sequence: I then entered {DELAY 3000}{PASSWORD} Now I can log in to a full screen game that doesn't allow pasting (I type in the username by hand first). If I'm alt-tabbed out of the game with KeePass in focus, the three second delay is enough time to go from triggering auto-type to restoring the full screen game window and clicking on the password field to give it focus. I was unable to trigger KeePass autotype with the game already full screen. If the account you're trying to log in to also has a long random username that needs to be auto-typed, you'll probably want a sequence like "{DELAY 3000}{USERNAME}{TAB}{PASSWORD}". Or, if the form doesn't allow you to tab from the username to the password field, you could use "{DELAY 3000}{USERNAME}{DELAY 3000}{PASSWORD}" and you can click on the password field during the second delay.
  - duxup 9y ago
    Thank you!

loginx 9y ago

You think that's bad? My damn BANK has the following password policy for online banking: The password you create here can be used to access Online, Mobile and Telephone Banking. All passwords must be six characters in length. Special characters (eg. *, %, $, etc) will not be accepted.

blacksmith_tb 9y ago
Banks are some of the worst - though oddly in many cases I've seen them support much more complex usernames than passwords. If you use a password manager you can generate large, random usernames to go with your tiny, weak password, potentially.
sleepybrett 9y ago
get a new bank, then tell them why.
- Spivak 9y ago
  I'm sure they will be heartbroken.
- forgotAgain 9y ago
  Send it in a certified letter. Address it to the CEO and send certified CC's to the FDIC, CIO, and a reporter for a local or national tech newspaper column. It may sound archaic but you have to raise the visibility if you're concerned about changing the banks behavior.
  - zild3d 9y ago
    People just tweet @ceo or @company these days, same effect