9 ms·

Can someone explain what security does forbidding pasting provide? My brain just can't comprehend it. Also, would a fix be a password manager that just ignores

Can someone explain what security does forbidding pasting provide? My brain just can't comprehend it. Also, would a fix be a password manager that just ignores the forbidding or is it done with JS somehow?

zaarn 8y ago
Forbidding pasting provides the security of having to click "Inspect elements" before the hacker can proceed. (Most PW manager plugins I know already ignore pasting properties, though a bank I was customer of circumvented that; the textbox was actually a DIV and they had coded the functionality of a textbox into it to prevent pasting)
- asdkhadsj 8y ago
  Yea, I ran into a bank that did that too. Then they proceeded to ask me a half dozen "security" questions from a massive list I could choose. Most of which I didn't know the answer to. I answered all of them (and put my answers down in my pw manager) with something like "X bank has terrible security, I hate this bank" - hoping that one day I'll have to answer those by phone haha.
  - ceejayoz 8y ago
    I thought I'd seen it all until I had to set my United Airlines security questions. Not only are the questions picked from a list, but the answers are. http://www.slate.com/articles/technology/future_tense/2016/03/united_airlines_uses_multiple_choice_security_questions.html http://www.slate.com/articles/technology/future_tense/2016/0...
  - tvanantwerp 8y ago
    I always answer the security questions with gibberish that I also save with my password manager. I now use a method like correct-horse-battery-staple to create answers, but I used to use long alphanumeric strings. I switched methods because, yes, one day I had to read the answer over the phone. Rep: "Tell me the answer to this question." Me: "Ok, let me see what I set it to..." Answer: F^O9dA66@wUPpK5$lTXBbrQ#yLP1EGl$ Me: "Oh... Oh no."
    - ceejayoz 8y ago
      I'm a bit worried about social engineering there. "Oh, it's a bunch of gibberish" may pass muster with a support rep (in both of your approaches), leading to compromise. Lately, I've been making up a seemingly correct, but random response (and different each time). My favorite vegetable? Sea cucumber! I store that in my password manager.
      - thaumasiotes 8y ago
        > I'm a bit worried about social engineering there. "Oh, it's a bunch of gibberish" may pass muster with a support rep (in both of your approaches), leading to compromise. I can confirm that this is the case. I provided a gibberish answer to a security question for Blizzard. I didn't bother to write it down, relying on not forgetting my password. I never forgot my password, but Blizzard shut down my account anyway because I was making payments with a card that was not listed as the account's "primary payment method". (The card I was using was listed on the account, but another card was the "primary payment method".) When I had to call support and answer my security question, the answer I'd filled in just meant that I wasn't required to provide the correct answer.
        zifnab06 8y ago
        I've found it's better to give them correct answers that are entirely fake. The make of your first car is an astin Martin. Your nearest sibling lives in lunar colony 1. This way "it's a bunch of gibberish" doesn't get past their security.
      - metafunctor 8y ago
        I use something like this: “the secret password is tango-seven-alpha-romeo-zero-zero-victor-sierra-foxtrot-quebec". Never had to use these for real yet, but it should be a bit harder to be seen as a “a bunch of gibberish”.
        ceejayoz 8y ago
        "Oh shoot, it was a bunch of random words. I'm so sorry, I had it written down but I can't find the paper..." Remember, an attacker can call support hundreds of times, getting a different rep every time. There's a good chance it'll work eventually.
  - mpeg 8y ago
    I did that at a certain corp, my security answers were all long sentences completely unrelated to the question (mostly things like "This question is useless" which made for some interesting phone conversations until they got it) Basically if you wanted to reset your employee password, which gave you access to corp vpn etc, you could call a 24/7 support line and give them your security answers. The problem with this is that most of the questions were not things that are inherently secure, things like "what was the name of your primary school" are easy to guess or research.
    - ceejayoz 8y ago
      > The problem with this is that most of the questions were not things that are inherently secure, things like "what was the name of your primary school" are easy to guess or research. They're also inherently unanswerable in many cases. As an example, I went to two different primary schools. I don't have a favorite musician or sports team, and the answer to "where did you meet your wife" might be the school, the city, or "in class". Last time I had to update my Apple security questions a good 80% of the questions weren't ones I felt I could answer in a way that'd be memorable a few years later.
      - pandler 8y ago
        Not to mention, these things are usually case sensitive. Sure, I can remember my childhood address, but how did I capitalize it? Did I abbreviate street? If I abbreviated street, did I add a period to make it "St." or "St"? Fortunately, I don't notice too many services requiring security questions these days. Unfortunately, most of them are banks or other services that probably also have my SSN.
- dstroot 8y ago
  USBank?
  - zaarn 8y ago
    Nop a german bank, they have stopped doing it somewhere around december last year.
herghost 8y ago
I believe that the argument they rely on is that if you're pasting it then you must have it written down somewhere so that you could have copied it. It's not a completely left-field position - it's definitely wrong in a modern context - however, previous years of security advice did focus on not writing passwords down. I have also heard that they believe the removal of the option to paste removes the ability of attackers to exercise brute force attacks against their site. This betrays a lack of understanding of multiple technologies, though.
- andybak 8y ago
  It's just as worrying to parrot advice that hasn't made sense for years than if they'd dreamt it up themselves. Whoever is in charge of security should have updated their knowledge in at least the last decade or so.
  - smolder 8y ago
    It's my experience that at some organizations, there is effectively no learning anything new beyond the hiring date from any outside source. They may hold very general training for uselessly shallow/fad stuff like "how to be an innovator" or "what the cloud means for our business" but those are generally not substantive efforts to improve the effectiveness of employees. They often set no goals and have no consequences for anyone. They're check boxes/busy work for upper management.
probably_wrong 8y ago
A couple (bad) examples I can think of: * you leave the password in the clipboard, and another website copies it (used to be a thing, I think it's patched now) * same case, but now a coworker comes to your unattended PC and retrieves the password by pasting it somewhere * allowing pasting would undermine the idea that you should never write your password down, and lead to a proliferation of files called "passwords.txt" on everybody's desktops None of this arguments is really good, but I can believe that they would be the result of a world without widespread password managers (also known as "the 90s") and tradition.
- Xylakant 8y ago
  > * allowing pasting would undermine the idea that you should never write your password down, and lead to a proliferation of files called "passwords.txt" on everybody's desktops "Never write a password down" has always been a bad idea. A file named "passwd.txt" on my desktop still is better than using a trivial password or the same password on all sites. It still requires compromise of my machine and prevents the password from being recovered from a dump of the pw-hashes.
  - C14L 8y ago
    And if your PC has full disk encryption and you lock your PC when afk, then its pretty close to a password manager.
    - Xylakant 8y ago
      No, there's a reason password managers should be preferred. For example, sometimes (browser) sandbox escapes grant reading of arbitrary files. Take for example the recently discussed malware scanner the sent the browsing history, it could read such a file and transfer it back.
      - UncleMeat 8y ago
        If you have malware on your device you lose already. It can just read memory out of your browser process and steal your passwords.
shawn 8y ago
There is no security benefit to forbidding pasting. https://www.troyhunt.com/the-cobra-effect-that-is-disabling/ https://www.troyhunt.com/the-cobra-effect-that-is-disabling/ Why do people do it? The same reason people believe /dev/random provides security benefits. It's important to ignore the correct things. (But it's often hard to figure out what to ignore.)
- theandrewbailey 8y ago
  Of course, because everyone should be using /dev/urandom instead. \s
Cthulhu_ 8y ago
As a naive non-security expert, I'd consider it a risk to put passwords in the clipboard - what if there's something that can read your clipboard? JS on another site for example? What if you accidentally paste it on a 3rd party site? That's copying it though. I know a decent password manager will clear the clipboard after an X amount of time too, mitigating the risk somewhat. But that's copying, not pasting in a field.
- foo101 8y ago
  How does a site disabling "paste from clipboard" protect my password that I have already copied to clipboard? Note that I would copy the password first and then I would realise that the site is not allowing me to paste it.
- virtualized 8y ago
  If a browser allows websites to read the clipboard, that's a security bug in that browser.
davchana 8y ago
Indian SBI Card does this, prevent pasting, & has set autocomplete=off to prevent browser from remembering the password. I got into Inspect Elements, removed autocomplete, & then typed in my password & then Chrome offered me to remember it. Now on subsequent logins, clicking into UserID does not trigger the saved id/pw combination dropdown from Chrome, but clicking in Password field does.
cuspycode 8y ago
I think it's "Cargo Cult Security". My hypothesis is that someone once realized that having a password stored in the clipboard could be bad, so let's just ban pasting passwords. The logic here is obviously completely backwards, but once a meme is out there it's hard to stop it.
jiveturkey 8y ago
For pasting of passwords, there is no security benefit. password managers ignore it. "They" often also disable pasting of other duplicated fields, like bank routing number, email address. So this shows why it is done (but misapplied to password). It's so you don't just copy and paste a wrong value that is hard for them to verify and leads to support calls. By forcing you to retype from scratch, the theory is you will either get it right twice or the error will be flagged.
- megaremote 8y ago
  This is so silly, I am more likely to get it wrong if I type it in than paste it in.
  - jiveturkey 8y ago
    but you aren't likely to type the same, matching error twice.

zaarn 8y ago

Forbidding pasting provides the security of having to click "Inspect elements" before the hacker can proceed. (Most PW manager plugins I know already ignore pasting properties, though a bank I was customer of circumvented that; the textbox was actually a DIV and they had coded the functionality of a textbox into it to prevent pasting)

asdkhadsj 8y ago
Yea, I ran into a bank that did that too. Then they proceeded to ask me a half dozen "security" questions from a massive list I could choose. Most of which I didn't know the answer to. I answered all of them (and put my answers down in my pw manager) with something like "X bank has terrible security, I hate this bank" - hoping that one day I'll have to answer those by phone haha.
- ceejayoz 8y ago
  I thought I'd seen it all until I had to set my United Airlines security questions. Not only are the questions picked from a list, but the answers are. http://www.slate.com/articles/technology/future_tense/2016/03/united_airlines_uses_multiple_choice_security_questions.html http://www.slate.com/articles/technology/future_tense/2016/0...
- tvanantwerp 8y ago
  I always answer the security questions with gibberish that I also save with my password manager. I now use a method like correct-horse-battery-staple to create answers, but I used to use long alphanumeric strings. I switched methods because, yes, one day I had to read the answer over the phone. Rep: "Tell me the answer to this question." Me: "Ok, let me see what I set it to..." Answer: F^O9dA66@wUPpK5$lTXBbrQ#yLP1EGl$ Me: "Oh... Oh no."
  - ceejayoz 8y ago
    I'm a bit worried about social engineering there. "Oh, it's a bunch of gibberish" may pass muster with a support rep (in both of your approaches), leading to compromise. Lately, I've been making up a seemingly correct, but random response (and different each time). My favorite vegetable? Sea cucumber! I store that in my password manager.
    - thaumasiotes 8y ago
      > I'm a bit worried about social engineering there. "Oh, it's a bunch of gibberish" may pass muster with a support rep (in both of your approaches), leading to compromise. I can confirm that this is the case. I provided a gibberish answer to a security question for Blizzard. I didn't bother to write it down, relying on not forgetting my password. I never forgot my password, but Blizzard shut down my account anyway because I was making payments with a card that was not listed as the account's "primary payment method". (The card I was using was listed on the account, but another card was the "primary payment method".) When I had to call support and answer my security question, the answer I'd filled in just meant that I wasn't required to provide the correct answer.
      - zifnab06 8y ago
        I've found it's better to give them correct answers that are entirely fake. The make of your first car is an astin Martin. Your nearest sibling lives in lunar colony 1. This way "it's a bunch of gibberish" doesn't get past their security.
    - metafunctor 8y ago
      I use something like this: “the secret password is tango-seven-alpha-romeo-zero-zero-victor-sierra-foxtrot-quebec". Never had to use these for real yet, but it should be a bit harder to be seen as a “a bunch of gibberish”.
      - ceejayoz 8y ago
        "Oh shoot, it was a bunch of random words. I'm so sorry, I had it written down but I can't find the paper..." Remember, an attacker can call support hundreds of times, getting a different rep every time. There's a good chance it'll work eventually.
- mpeg 8y ago
  I did that at a certain corp, my security answers were all long sentences completely unrelated to the question (mostly things like "This question is useless" which made for some interesting phone conversations until they got it) Basically if you wanted to reset your employee password, which gave you access to corp vpn etc, you could call a 24/7 support line and give them your security answers. The problem with this is that most of the questions were not things that are inherently secure, things like "what was the name of your primary school" are easy to guess or research.
  - ceejayoz 8y ago
    > The problem with this is that most of the questions were not things that are inherently secure, things like "what was the name of your primary school" are easy to guess or research. They're also inherently unanswerable in many cases. As an example, I went to two different primary schools. I don't have a favorite musician or sports team, and the answer to "where did you meet your wife" might be the school, the city, or "in class". Last time I had to update my Apple security questions a good 80% of the questions weren't ones I felt I could answer in a way that'd be memorable a few years later.
    - pandler 8y ago
      Not to mention, these things are usually case sensitive. Sure, I can remember my childhood address, but how did I capitalize it? Did I abbreviate street? If I abbreviated street, did I add a period to make it "St." or "St"? Fortunately, I don't notice too many services requiring security questions these days. Unfortunately, most of them are banks or other services that probably also have my SSN.
dstroot 8y ago
USBank?
- zaarn 8y ago
  Nop a german bank, they have stopped doing it somewhere around december last year.

herghost 8y ago

I believe that the argument they rely on is that if you're pasting it then you must have it written down somewhere so that you could have copied it. It's not a completely left-field position - it's definitely wrong in a modern context - however, previous years of security advice did focus on not writing passwords down. I have also heard that they believe the removal of the option to paste removes the ability of attackers to exercise brute force attacks against their site. This betrays a lack of understanding of multiple technologies, though.

andybak 8y ago
It's just as worrying to parrot advice that hasn't made sense for years than if they'd dreamt it up themselves. Whoever is in charge of security should have updated their knowledge in at least the last decade or so.
- smolder 8y ago
  It's my experience that at some organizations, there is effectively no learning anything new beyond the hiring date from any outside source. They may hold very general training for uselessly shallow/fad stuff like "how to be an innovator" or "what the cloud means for our business" but those are generally not substantive efforts to improve the effectiveness of employees. They often set no goals and have no consequences for anyone. They're check boxes/busy work for upper management.

probably_wrong 8y ago

A couple (bad) examples I can think of: * you leave the password in the clipboard, and another website copies it (used to be a thing, I think it's patched now) * same case, but now a coworker comes to your unattended PC and retrieves the password by pasting it somewhere * allowing pasting would undermine the idea that you should never write your password down, and lead to a proliferation of files called "passwords.txt" on everybody's desktops None of this arguments is really good, but I can believe that they would be the result of a world without widespread password managers (also known as "the 90s") and tradition.

Xylakant 8y ago
> * allowing pasting would undermine the idea that you should never write your password down, and lead to a proliferation of files called "passwords.txt" on everybody's desktops "Never write a password down" has always been a bad idea. A file named "passwd.txt" on my desktop still is better than using a trivial password or the same password on all sites. It still requires compromise of my machine and prevents the password from being recovered from a dump of the pw-hashes.
- C14L 8y ago
  And if your PC has full disk encryption and you lock your PC when afk, then its pretty close to a password manager.
  - Xylakant 8y ago
    No, there's a reason password managers should be preferred. For example, sometimes (browser) sandbox escapes grant reading of arbitrary files. Take for example the recently discussed malware scanner the sent the browsing history, it could read such a file and transfer it back.
    - UncleMeat 8y ago
      If you have malware on your device you lose already. It can just read memory out of your browser process and steal your passwords.

shawn 8y ago

There is no security benefit to forbidding pasting. https://www.troyhunt.com/the-cobra-effect-that-is-disabling/ https://www.troyhunt.com/the-cobra-effect-that-is-disabling/ Why do people do it? The same reason people believe /dev/random provides security benefits. It's important to ignore the correct things. (But it's often hard to figure out what to ignore.)

theandrewbailey 8y ago
Of course, because everyone should be using /dev/urandom instead. \s

Cthulhu_ 8y ago

As a naive non-security expert, I'd consider it a risk to put passwords in the clipboard - what if there's something that can read your clipboard? JS on another site for example? What if you accidentally paste it on a 3rd party site? That's copying it though. I know a decent password manager will clear the clipboard after an X amount of time too, mitigating the risk somewhat. But that's copying, not pasting in a field.

foo101 8y ago
How does a site disabling "paste from clipboard" protect my password that I have already copied to clipboard? Note that I would copy the password first and then I would realise that the site is not allowing me to paste it.
virtualized 8y ago
If a browser allows websites to read the clipboard, that's a security bug in that browser.

davchana 8y ago

Indian SBI Card does this, prevent pasting, & has set autocomplete=off to prevent browser from remembering the password. I got into Inspect Elements, removed autocomplete, & then typed in my password & then Chrome offered me to remember it. Now on subsequent logins, clicking into UserID does not trigger the saved id/pw combination dropdown from Chrome, but clicking in Password field does.

cuspycode 8y ago

I think it's "Cargo Cult Security". My hypothesis is that someone once realized that having a password stored in the clipboard could be bad, so let's just ban pasting passwords. The logic here is obviously completely backwards, but once a meme is out there it's hard to stop it.

jiveturkey 8y ago

For pasting of passwords, there is no security benefit. password managers ignore it. "They" often also disable pasting of other duplicated fields, like bank routing number, email address. So this shows why it is done (but misapplied to password). It's so you don't just copy and paste a wrong value that is hard for them to verify and leads to support calls. By forcing you to retype from scratch, the theory is you will either get it right twice or the error will be flagged.

megaremote 8y ago
This is so silly, I am more likely to get it wrong if I type it in than paste it in.
- jiveturkey 8y ago
  but you aren't likely to type the same, matching error twice.