13 ms·
The nuance here is that brain-damaged appsec pentesters reported this as a vulnerability for years, and so tons of websites followed that advice and dutifully d
by airza 5y ago
The nuance here is that brain-damaged appsec pentesters reported this as a vulnerability for years, and so tons of websites followed that advice and dutifully disabled the functionality.
But autocomplete has advantages: it lets users easily specify long, random, per-site passwords without ever having to worry about that. And when they can't do that, a pretty large percentage of them just give up and write the password down somewhere.
In the end, i find a lot of chrome's decision to implement spec-breaking behavior awful in the context of having a website that works forever (Looking at you, samesite). But this behavior rarely breaks functionality and on the whole makes the web a lot more secure.
- callamdelaney 5y agoI'd go a step further and say if my password manager doesn't play nice with a website, I'm less likely to use that website.
- izacus 5y agoOh man, enterprise "security" firms used by banks and other old behemoths are a cancer for users. If you want your website to actively abuse users (especially one with special needs and pretty much anyone that doesn't fit into an "made up average person mold") get those people on board and listen to the dumb things they say. I still can't believe that whole business managed to interpret 2FA for whole EU as "you MUST use SMS for 2FA!".
- thaumasiotes 5y ago> I still can't believe that whole business managed to interpret 2FA for whole EU as "you MUST use SMS for 2FA!". Weeeeeelll... I'm familiar with two (2) common kinds of "2FA" implementations. TOTP and SMS. Of those two, only SMS is actually a second factor, albeit not a particularly secure one. TOTP is fundamentally a password, and two passwords are no different than one password.
- wffurr 5y agoDoesn’t answering a TOTP challenge prove that you “have” the HMAC shared key that seeds the code generator?
- thaumasiotes 5y agoYes, that shared key is a password, a piece of knowledge known in common between you and them.
- jimktrains2 5y agoA password is something you're supposed to "know", i.e. something in your head. A second factor is something you have, i.e. your phone, a hardware token, or access to a shared secret you don't store in your head. Password managers kind of mangle the idea and turn the password from something you know to something you have.
- thaumasiotes 5y agoA password is information, something that can be freely duplicated. The idea of "something you have" is that the thing can't be duplicated. As soon as it can, it's no longer "something you have". Any number of people might have it. A person who has it might not be you. SMS hijacking, for example, converts your phone-based authentication to a password, where the password is your phone number. (Since an attacker who knows that number can pass the test.) TOTP starts its life as a password.
- tremon 5y agoYes, it starts its life as a password. After that, it is never communicated ever again, and therefore, after the initial exchange, it's something you have. It seems to me you are ascribing properties to "something you have" that aren't warranted. The "something you have" needs to prove you were party to the initial exchange, not necessarily that you were the only one present -- that's why we use two factors, and not only TOTP.
- dkdbejwi383 5y agoThe product I work on now logs users out after 15 minutes. It's a service where the average user would probably spend a good few hours of their day. We're actively harming the user experience (and driving paying customers away) because of some "expert" advice.
- Cthulhu_ 5y agoAfter 15 minutes, or 15 minutes of inactivity? The latter is defensible at least, in e.g. a public area where there is a risk of people leaving their desktops without locking them. I mean that's another policy issue that can be addressed (a policy that locks a system after x amount of inactivity), but as an app developer you can't know much about the system things are running on.
- Retric 5y agoCareful. Filling out a long form isn’t 15 minutes of inactivity, but a huge range of websites assume it is.
- hallway_monitor 5y agoPTSD causes me to copy and paste big blocks of text out of a text area before submitting every time.
- ta988 5y agosounds like what an extension could do. store in localstorage the last hour of forms. I especially hate clicking submit to get an error and an empty form again.
- alistairSH 5y agoUgh, a form that takes 15 minutes or more to fill out, without any feedback or other interaction, is itself a UX problem. It should at least be auto-saving.
- PebblesRox 5y agoI use Coface for work to check credit for potential customers. Instead of a password, they require a 6-digit pin. It can't be auto-filled or entered with the keyboard. There's an on-screen number pad that you have to click on and the numbers are scrambled - they show up in a different arrangement every time. Such a pain!
- ShaneMcGowan 5y agoAh yes, the 2005 RuneScape bank method of security, very high tech
- hedora 5y agoYou could probably outsource the pin entry to a human or AI based third party service.
- colejohnson66 5y agoSuch as Amazon’s Mechanical Turk?
- _jal 5y agoI think this is the manifestation of non-logical associations humans make. When I was a kid, a teacher told me learning was supposed to be hard and unpleasant, and I believed her for a long time. Only when I started enjoying myself in spite of that did I see it was wrong, and I started doing well in school, and (more importantly) pursuing my own interests. There's a similar thing with security - people assume good security must be painful, so making it painful becomes a goal. Sometimes this is sincere, sometimes (TSA) intentional theater. But either way, the result is intentional hostility to the people who use the system. I'd bet money they have a one-sentence answer for why it does each of those things ("order is scrambled to prevent shoulder-surfing"), but have done zero testing to determine whether those theories are correct.
- ascar 5y agoI always associated these with key logging prevention. What drives me nuts however, is websites/apps that allow me to type my password but not paste it. Like they want to force that a keylogger can grab it? Another favorite of mine are password conposition rules, which do nothing but reduce security and are everywhere :(
- lmilcin 5y agoAutocomplete has one huge, glaring disadvantage: the passwords are stored on your computer, in reversible form.
- kikoreis 5y agoYes, but let's be fair, it's a galaxy better than writing it on a post-it or password booklet, and still way better than using a memorable passphrase which will get reused and then leaked. Besides, you can encrypt the local storage with a master password (and if you accept online as a requirement, you could even add 2FA to that).
- m-p-3 5y agoThe password booklet can be secure if you have good physical security, and is immune to a software zero-day and autocomplete exploits.
- teknopaul 5y agothis x 10, computer security is usually flawed, personal security is (bar a few war zones) much better.
- weswpg 5y agothere are a lot of war zones in this world though. given that and the number of Third World countries with high levels of crime and poor public security, I suspect that a significant percentage of the worlds technology-using population might have better digital security than physical security
- m-p-3 5y agoIt's always about evaluating your OPsec and tailoring it to your needs and threat assesment.
- Mordisquitos 5y ago
- himinlomax 5y agoI don't even know if it was security consultants who ever recommended that. It's the same thing with disabling pasting into password fields. A lot of websites used to do that, many probably still do, but I have never seen a security team, no matter how braindead, recommend that nonsense. Rather, it's well-intentioned but stupid project managers following industry worst practices. You can't get in trouble for doing what everybody else is doing, no matter how terrible, I guess.
- schnable 5y agoDitto for credit card number entries. I use Dashlane to copy my CC info out of, and if that doesn't work, there is a good chance I'm not buying on your site. Maddening and pointless. I agree this is probably product managers, but may also be engineers who have strongly held "security" opinions and nobody to check them.
- qwertox 5y agoThis really used to be an issue when some JavaScript code constantly checked for new data in those inputs in hopes to find something interesting, like some personal info which shouldn't be there. But I fully agree with the disable-paste stuff. Very few (web-related) things get as annoying as that.
- throwawayboise 5y agoIf you're on *nix, I've found that middle-click will usually work even if "CTRL-V" or right-click->paste is disabled. Something about the handling of Primary Selection vs. Clipboard in X11.
- duxup 5y ago>i find a lot of chrome's decision to implement spec-breaking behavior awful I recall working with some folks who supported load balancers when Chrome decided that something seemed 'unnecessary' and they updated Chrome and ... it broke load balancing.
- dhimes 5y agoMaybe it's just me but I can't trust Chrome with my passwords anyway. It seems like every update they wipe out the store. So I only use Chrome for GSuite (or whatever they call it now). And, of course, I have to use a pw I can remember. My biggest security vuln is Google. And I've seen too many new account usernames out there like forgotlastpasspw to use an external manager. Firefox, thankfully, keeps the passwords.
- oblvious-earth 5y agoI used to support a client facing app at a bank and the appsec pentesters were a joke: * Username and Password fields must not autocomplete * Username and Password fields must not allow text to be pasted in to the field * Password must be at least 8 characters with lower case, upper case, numbers, and special characters (they didn't care it had a maximum length of 8 characters) I straight up told our project management it was actively hurting our security, and was told the the point here was to fulfill a regulatory requirement to complete and resolve all issues from a independent "pentest" not to improve security.
- shp0ngle 5y agoAhhhh, so that's why banks specifically often don't allow automatic filling/pasting. It's because it's in some dumb regulatory pentest manual or something. OK.
- timw4mail 5y agoI think PCI standards are pointing to some of this nonsensical advice.
- jwr 5y agoIn these cases, it makes sense to point people to NIST Special Publication 800-63B (Digital Identity Guidelines) https://pages.nist.gov/800-63-3/sp800-63b.html https://pages.nist.gov/800-63-3/sp800-63b.html — their guidelines are pretty good and eliminate much of the braindead nonsense that is considered "accepted practice in the industry".
- vunuxodo 5y agoTaken to the extreme is the US Government's TreasuryDirect website, where individuals can buy savings bonds. Instead of allowing you to type your password, they render a "virtual keyboard" that you have to use your mouse to click the keys one by one. Oh, and that password? Not case sensitive.
- 5y ago
- nevi-me 5y agoThis stuff matters, and I hadn't thought of it in the way you're putting it. One of our local banks disabled autofill without warning, and they went out of their way to detect if someone was pasting a password. There was backlash and frustration, and they eventually reversed the decision. After reversing it, they still put a disclaimer about not pasting passwords, but that disappeared after a few weeks.
- eganist 5y ago> The nuance here is that brain-damaged appsec pentesters reported this as a vulnerability for years as a low-risk privacy defect yes, because things like bank account and routing numbers would be stored in autofills for certain banking sites that don't require authn/authz to initiate a transfer. (I can think of a handful of platforms frequently used for common services like paying HOA fees which are currently vulnerable to this, meaning another user sharing the machine can simply hit ⬇ on the keyboard in form fields on a page that doesn't require authn/authz to initiate an external transfer in order to capture any stored banking details that were previously entered into the form.) Source: I was one of those brain-damaged appsec pentesters.