9 ms·
Another rule: make all fields pastable. If you have a form I can't fill in with my password manager, I can copy and paste my username and password with my passw
by joshuaheard 8y ago
Another rule: make all fields pastable. If you have a form I can't fill in with my password manager, I can copy and paste my username and password with my password manager. Unless... you make those fields so I can't paste into them. Then, I have to open two windows side by side and manually type in my 16 digit password with caps, numbers, and symbols. Tedious.
- labster 8y agoIt's easier to just hack the HTML IME. If pasting is blocked in JS, and the site has a (probably ancient) version of jQuery installed, just throw this in the console: $('*').unbind('paste');
- Spoom 8y agoThere are also Chrome extensions that will attempt to remove any such restrictions automatically, like https://chrome.google.com/webstore/detail/dont-fuck-with-paste/nkgllhigpcljnhoakjkgaieabnkmgdkb?hl=en https://chrome.google.com/webstore/detail/dont-fuck-with-pas...
- folkrav 8y agoLooks like it's also available for Firefox https://addons.mozilla.org/en-US/firefox/addon/don-t-fuck-with-paste/ https://addons.mozilla.org/en-US/firefox/addon/don-t-fuck-wi...
- oefrha 8y agoLovely. I wish this were possible for some stupid mobile apps too, which tend to be extremely painful (triply so for ones that clear the password field as soon as I switch to 1Password to read the next five characters).
- danlugo92 8y agoSadly doesn't work with one of my banks (it detects the ctrl key on keydown)
- DCoder 8y agoTry Shift-Ins instead. It also performs pasting, but fewer people seem to be aware of it. Trivia: Shift-Ins actually predates Ctrl-V :-)
- mercer 8y agoThis extension can read and change all data on any website I visit. While I understand that this is necessary for it to work, am I alone in being very uncomfortable installing it for something so trivial (or, perhaps, at all)?
- lanterk 8y agoMaybe. But then again, this is the only available permission.
- lnl 8y agoThis is why I prefer userscripts instead of extensions for simple things like this. Usually, they can be achieved with a single or few lines of code; even though I am not a programmer (and certainly not a Javascript programmer) I can often write one with a little bit of research. No need to extend the attack surface with yet another extension for every little thing. You might be able to inspect the code of an extension, but it is less straightforward and easy compared to a simple userscript. Plus, with a userscript, there is no risk of the extension author turning malicious and updating it with malware, even if it was clean at one point. My rule of thumb is using userscripts to modify websites' behavior, and using extensions to modify the browser's behavior. (At least that is the case for Firefox 56: Firefox Quantum and Chrome limits extensions from modifying the browser much; often they are little more than glorified userscripts.)
- qrbLPHiKpiux 8y agoWe're talking about the general public! Can you imagine the phone conversation I would have with my dad about this? It would end in WW3.
- jtms 8y agorouter passwords taped to the back of the router is about as sophisticated as the “password management” gets for mine (or hand written on a random page of a 99 cent spiral notebook)
- gourmetghetto 8y agoThis is awesome and I can't believe it's the first it's ever crossed my mind. Good stuff.
- zachberger 8y agoThis is great, but not easy to get into a console on mobile. I always struggle with United Airline's wifi which prevents paste, and I always try to access from mobile.
- kccqzy 8y agoYou can use a bookmarklet. I don't have one for restoring paste, but I have ones for setting viewport width to desktop and it works really well (iOS Safari).
- Merad 8y agoIn Firefox you can disable this stuff by setting dom.event.clipboardevents.enabled to false.
- eropple 8y agoThis will also break stuff like pasting an image via Ctrl-V if it's in your clipboard buffer, though. Be warned.
- mistercow 8y agoOr inspect element, then $0.value = 'hunter2'
- mercurywells 8y agoOne good justification for this is so it doesn't hinder accessibility for users that have difficulty typing.
- da_chicken 8y agoI've never understood this desire to make a web site behave like it isn't a web site. The entire benefit of web sites is that they've got a consistent interface even between web sites. Don't break that! Don't break copy and paste. Don't break the back button. Don't change or break the right click/context menu. Don't hide the toolbars.
- smadge 8y agoDon't have any application state transitions that are not hyperlinks or a forms.
- baddox 8y agoHmm, what about upvoting or liking a post? Or do you consider an AJAX POST request a “form?” There are also some more obvious smaller examples, like expanding/collapsing an accordion menu.
- smadge 8y agoYou could implement an upvote or like as a hyperlink or a form, then progressively enhance that feature to not initiate a full page reload (iirc this is how HN implements upvotes). Similarly expanding or collapsing an accordion menu could be a hyperlink which by default does request the additional content but which can be progressively enhanced to provide that feature with JavaScript for user agents that support it. As an added benefit to supporting more clients, I find it easier to reason about the state of the view when it is encoded entirely in the URL, and available state transitions being to be encoded using features of well known media types like html. This is one of the main benefits of REST: any user or user-agent which knows the media type knows how to interact with the application.
- dkersten 8y agoIt makes some sense to have an upvote be a form that posts somewhere and the response of which is a redirect (maybe a 307?) back to the page you’re on and then the progressive JavaScript enhancement would be to perform the request asynchronously instead of redirecting. It makes sense because adding an upvote is the same as adding other form data to a database semantically so really should be treated the same way.
- emn13 8y agoIf you use keepass, that'll happily autotype into pretty much anything. Obviously autofill is nicer, but that works even for non-browser apps, so it's nice to have.
- argd678 8y agoThey do this to thwart hackers, for example to prevent a script that inputs the same password across many accounts. It’s terrible UX for sure.
- gibybo 8y agoWe're going to be in trouble when hackers learn how to get around javascript that disables copy/paste.
- aaaaaaaaaaab 8y agoLol, that’s not how “hacking” works
- breatheoften 8y agoMore like “protect against ‘hackers’” they invited into their site via all the insane 3rd party tracker scripts they embed on the page ... I think “protecting” against attacks (and/or accidentally leaking password details) from these kind of sources has to be a big part of the reasoning that has lead so many big sites to make their login experiences so insanely horrible. There must be a tracker network or big consultant out their that popularized these kinds of techniques and marketed them as a “low hanging fruit defense in depth best practice” ...
- nojvek 8y agoHa. Right click -> inspect element. In dev tools console. $0.value =“password”. I use that in reverse when I can’t remember a password. Get the value from input element gives the browser remembered passwords. Works on other peoples machines too. If you wanna steal remembered passwords. That’s how chrome extensions steal passwords. Just sayin.
- siedes 8y agoSomeone debunk this so I can sleep at night.
- Wowfunhappy 8y agoI think this is the same thing my javascript bookmarklet does automatically to reveal saved passwords (when I can’t remember them). The bookmarklet works everywhere I’ve ever tried it, and was super useful before I switched to a real password manager. So, consider this an anti-debunk.
- recursive 8y agoOh boy, get ready to be awake.
- int_19h 8y agoWhat is there to debunk? Someone who has access to your browser, has access to all your browsing data - of course! This includes saved passwords.
- jtms 8y agograb some ambien - you’re going to need it!
- tedmiston 8y agoAnother trick you can do is change the field type from password to text in the web inspector, which will also reveal the password in plaintext.
- 8y ago
- jtms 8y agoYeah the disabling of paste into the password field is super annoying. My work around is to open the developer console and paste into a js one liner that sets the value of said form field. For me it’s slightly better than the tedious manual entry and I get to wave my fist at the screen in self righteous indignation: “no one tells me when I can and can’t copy/paste!”
- aasasd 8y agoPro tip: usually only the keyboard shortcut is disabled, but not the ‘paste’ item in the context menu. And overriding the context menu, in turn, can be disabled in the browser flags afaik (at least in FF). Or, the ‘Edit’ menu is there.
- nielsbot 8y agoYou can also sometimes temporarily turn off JS in your developer settings, paste, then re-enable it.
- deleted 8y ago[deleted]
- bobbylarrybobby 8y agoI use the app keyboard maestro to type out my keyboard contents character by character (although it can do a hell of a lot more than that), which bypasses paste blocking.
- peteretep 8y agoI would love Apple to add this to their app review process, as some apps also disable pasting. In addition, force all apps to allow password managers.
- swiftcoder 8y agoIn a sense Apple has ended up fairly close to this by providing native integration between the system keyboard and password managers.
- tedmiston 8y agoMost sites that hijack and block pasting via JavaScript are easily circumvented by pasting somewhere else nearby, such as the location bar (without hitting return), then dragging and dropping that value onto the field of interest.
- dingaling 8y agoA clever hack but perhaps not one to use in browsers like Chrome which do dynamic search lookups.
- radium3d 8y agoI've noticed this on certain bank sites. It's not enhancing security as their developers must assume, it's quite the opposite because of the reduction of the chance users will utilize the password manager which generates secure passwords and stores them encrypted on their devices.
- gesman 8y agoBanks do that when adding new credit cards or checking account numbers and so on. Presumably for making it more secure
- alkonaut 8y agoSomeone at my company suggested it (not an expert) when we discussed a new login UI. When I had a meltdown and asked WHY!? The response was “oh, I didn’t understand it was controversial and I thought everyone blocked paste for security”. So that kind of explains why it’s done. It’s a misinformed cargo cult.
- 01100011 8y agoOne more reason to love Linux and X Windows: highlight password, middle-click into the field. You can take away ctrl-v, but you can't take away my X Windows clipboard.
- usr1106 8y agoHighlight and middle click is the X11 primary selection. In my experience Firefox (and Emacs) do not always play well.
- PunksATawnyFill 8y agoAnother rule: DON'T FORCE PEOPLE TO USE AN E-MAIL ADDRESS AS THEIR USER ID. Such an amateur-hour mistake: https://goldmanosi.blogspot.com/2012/06/forcing-people-to-use-e-mail-address-as.html https://goldmanosi.blogspot.com/2012/06/forcing-people-to-us...
- kijin 8y agoPeople use the same user ID all over the place anyway. That includes the part before the "@" in their email address. If any one of those credentials is leaked, the damage is the same. At least the email address can be easily changed when needed, whereas most sites don't allow changing the user ID.
- dingaling 8y agoMany years ago I used a forum that autogenerated usernames from a hash of responses to questions ( player name, age, city etc ) in a similar manner to those 'porn name' algorithms. Which was quite a relief in place of the usual 'invent a unique name' mindblank I often suffer. Similarly my banks issue me my website user strings. Why do so many website permit users to choose? Forcing the user to write-down their assigned designator might lead to better security, too, since they would seem at that point more open to writing-down a strong password.
- Dylan16807 8y agoThat's not at all convincing. A username+password is probably more likely to be reused than email+password.
- alkonaut 8y agoI prefer having to just hit “forgot password” over hitting first “forgot username” and then forgot password... Even with the security risks I prefer email login. Logins are in 2 categories: a) stuff I don’t care if it’s compromised. Basically forum memberships, preferences on various sites such as retailers storing a shipping address but no payment details. b) Important things such as my email account. For category a) sites (hundreds) I use a crap password that has been owned already. It’s 5 chars and the same on most sites. It’s been in pwned dbs for years. I can’t be bothered to use a person manager if it’s more work than 5 keystrokes to do on any platform. For category b) sites (say ten or something) I use long unique passwords and 2FA. Obviously it’s better to put everything in b), but I’m lazy. So as a good second best I take good care of the important passwords.
- muzani 8y agoThere's a bank website that disables pasting into the website forms, presumably for security reasons. They also force me to use a 8 character password with special characters, numbers, uppercase and lowercase. I no longer use it as my main bank as it's way too tedious to log in to.
- michaelcampbell 8y agoAmen to that. There are chrome extensions (and Tampermonkey, etc.) things that will return paste-ability to sites that turn it off.
- willfiveash 8y agoOn my Mac I use a utility called Quicksilver that has an option to record and recall copies I've done then shows me a list of the last 10 copies from which I can drag one of them into an input field. This works on input fields that don't allow normal copy/paste. Quicksilver does a number other things like app launching -- I'm a fan.
- neop1x 8y agoYes, good point! I also hate it with credit cards. I have my credit card stored in the keychain and some pages make it impossible to paste the credit card code. They expect me to type it digit by digit like an idi*t. That makes me avoid such services if possible.