12 ms·

We regularly get "pentest" results where the top recommendation is to disable pasting of passwords.

• olig15 3y ago
  What is the idea behind this? The only thing I can think of (I’m not a web developer, so might be missing something obvious) is that it would ‘stop’ third party tools from being able to automate the login flow. But if that was the case, couldn’t they just change the html/JavaScript to allow pasting again? As far as I know, blocking of pasting into forms is a fully client-side setting.
  • shmapf 3y ago
    I presume it's because when you copy a password to the clipboard, another app can view it.