4 ms·

One day I will find the security consultant who keeps going around companies and telling them that letting me paste content is insecure. On many platforms I use

by nikanj 7y ago

One day I will find the security consultant who keeps going around companies and telling them that letting me paste content is insecure. On many platforms I use a password like "Fart123!!" because I can't paste "$3f4[FEsz$%643we]]SFv" from my password manager.

RonanTheGrey 7y ago
Firefox's "Don't Fuck with Paste" extension is a lifesaver. It disables all the event handlers on the page and the input that prevent pasting. Kind of a sledgehammer but when you're pasting someone's 26-digit account number, I mean.. you don't want to copy that by hand. Plus I use Bitwarden, which auto-fills the boxes so I don't need to paste passwords at least.
- lstamour 7y ago
  I wish I could say this 2014 article was completely out of date, but while some folks have updated, far too many sites still haven’t: https://www.troyhunt.com/the-cobra-effect-that-is-disabling/ https://www.troyhunt.com/the-cobra-effect-that-is-disabling/ If you’re writing a little JS snippet to “fix” this, https://gist.github.com/nuxero/6dda1287ccfb91999e9f8c42d7246fd3 https://gist.github.com/nuxero/6dda1287ccfb91999e9f8c42d7246... or https://gist.github.com/SukkaW/26dc57f3bf3d7f17a89763dcd9f7d3a1 https://gist.github.com/SukkaW/26dc57f3bf3d7f17a89763dcd9f7d... might also help. It should be possible to add this to iOS using the Shortcuts app. https://support.apple.com/en-us/guide/shortcuts/apd218e2187d/ios https://support.apple.com/en-us/guide/shortcuts/apd218e2187d... Though... I’m not entirely sure you can block pasting in Safari on iOS. I can’t say I’ve noticed it there, perhaps the native keyboard password manager integration avoids it.
  - aspenmayer 7y ago
    I recently had a broken phone screen and had to find a password entry workaround. On iOS pasting in fields that show the iOS keyboard seems to always be enabled, but rotation of the keyboard in landscape mode is disabled on some password entry fields for some reason. A quick workaround is the notes app for a quick copy paste and the calculator app for numbers if needed, although I wish there was a way to toggle comma separation in the iOS calculator.
- Merad 7y ago
  You don't need an extension for this, you can go into about:config and flip dom.event.clipboardevents.enabled to false.
  - snazz 7y ago
    Doesn't that disable other clipboard events, though? There are quite a few other sites that I want to be able to use copy/paste events correctly.
    - jjeaff 7y ago
      Ya, anytime a site uses a contenteditable element, they usually need to listen for paste content and do things like stripping html tags and whatnot. Basically any wysywig style editor like a Facebook post.
- nfriedly 7y ago
  Link: https://addons.mozilla.org/en-US/firefox/addon/don-t-fuck-with-paste/ https://addons.mozilla.org/en-US/firefox/addon/don-t-fuck-wi...
twic 7y ago
You can fire up developer tools and paste into the value attribute. This will work on an old-school form, but i have no idea what it will do to client-side JavaScript!
- Traubenfuchs 7y ago
  You can paste in the value and then change the value to something wrong and to the right thing back again. This will make sure that the required events will fire.
greendestiny_re 7y ago
Please don't ever post your passwords, even in jest. The web is filled with crawlers that scrape passwords and add them to vast password dictionaries to be used in cracking.

by nikanj 7y ago

RonanTheGrey 7y ago

Firefox's "Don't Fuck with Paste" extension is a lifesaver. It disables all the event handlers on the page and the input that prevent pasting. Kind of a sledgehammer but when you're pasting someone's 26-digit account number, I mean.. you don't want to copy that by hand. Plus I use Bitwarden, which auto-fills the boxes so I don't need to paste passwords at least.

lstamour 7y ago
I wish I could say this 2014 article was completely out of date, but while some folks have updated, far too many sites still haven’t: https://www.troyhunt.com/the-cobra-effect-that-is-disabling/ https://www.troyhunt.com/the-cobra-effect-that-is-disabling/ If you’re writing a little JS snippet to “fix” this, https://gist.github.com/nuxero/6dda1287ccfb91999e9f8c42d7246fd3 https://gist.github.com/nuxero/6dda1287ccfb91999e9f8c42d7246... or https://gist.github.com/SukkaW/26dc57f3bf3d7f17a89763dcd9f7d3a1 https://gist.github.com/SukkaW/26dc57f3bf3d7f17a89763dcd9f7d... might also help. It should be possible to add this to iOS using the Shortcuts app. https://support.apple.com/en-us/guide/shortcuts/apd218e2187d/ios https://support.apple.com/en-us/guide/shortcuts/apd218e2187d... Though... I’m not entirely sure you can block pasting in Safari on iOS. I can’t say I’ve noticed it there, perhaps the native keyboard password manager integration avoids it.
- aspenmayer 7y ago
  I recently had a broken phone screen and had to find a password entry workaround. On iOS pasting in fields that show the iOS keyboard seems to always be enabled, but rotation of the keyboard in landscape mode is disabled on some password entry fields for some reason. A quick workaround is the notes app for a quick copy paste and the calculator app for numbers if needed, although I wish there was a way to toggle comma separation in the iOS calculator.
Merad 7y ago
You don't need an extension for this, you can go into about:config and flip dom.event.clipboardevents.enabled to false.
- snazz 7y ago
  Doesn't that disable other clipboard events, though? There are quite a few other sites that I want to be able to use copy/paste events correctly.
  - jjeaff 7y ago
    Ya, anytime a site uses a contenteditable element, they usually need to listen for paste content and do things like stripping html tags and whatnot. Basically any wysywig style editor like a Facebook post.
nfriedly 7y ago
Link: https://addons.mozilla.org/en-US/firefox/addon/don-t-fuck-with-paste/ https://addons.mozilla.org/en-US/firefox/addon/don-t-fuck-wi...

twic 7y ago

You can fire up developer tools and paste into the value attribute. This will work on an old-school form, but i have no idea what it will do to client-side JavaScript!

Traubenfuchs 7y ago
You can paste in the value and then change the value to something wrong and to the right thing back again. This will make sure that the required events will fire.

greendestiny_re 7y ago

Please don't ever post your passwords, even in jest. The web is filled with crawlers that scrape passwords and add them to vast password dictionaries to be used in cracking.