4 ms·

To work around this I usually drag and drop text pasted into the URL field or somewhere, on my Mac at least. Can I just say though that disabling paste, appare

To work around this I usually drag and drop text pasted into the URL field or somewhere, on my Mac at least. Can I just say though that disabling paste, apparently in the name of security, is the dumbest shit I have ever encountered, right in front of ultra short timeouts everywhere. If only I could meet the people who make these decisions in person...

twobitshifter 3y ago
Here was a dumb one from me the other day. - I had to use login.gov - My password manager had a saved login for it, I didn’t remember it, but it worked - Then the site asked me for an authenticator app code. I checked my authenticator apps and there was nothing there for login.gov. - There’s a login another way button so I click that and the other way is use the authenticator app! - I click what if I can’t get my code? - It says I must DELETE my account. - I click to delete my account and it sends me an email. - The email says to wait 24 hours for another account deletion email. - 24 hours later I get an email that allows me to delete my account. What was in the account? I have no idea, but it seems that it must be sensitive for some uses of the login. But if it’s sensitive and important why am I able to delete the account, the most destructive thing? Why is an email enough for me to delete it but not enough for me to get an auth code?
- wccrawford 3y ago
  I would guess that the 24 hour delay is to allow the real owner of the account a change to cancel the delete if someone tries to mess with their account. That said, you're right. This is really weird.
  - erhaetherth 3y ago
    How is the real owner going to know to cancel the delete? Did it send them...an email?
- m3047 3y ago
  It's been too long and I don't clearly remember, but I think I had to use login.gov to establish an account for mumble. There was an option to print out a onetime pad (for 2FA); I chose it just for kicks. Haven't used it but I have it on file "against the day" I lose my normal second factor.
- bobbylarrybobby 3y ago
  While an attacker being able to use just a password (and no 2fa) to delete someone else’s account is pretty bad, stealing information from their account may well be worse. There is a lot of personal information that I have that I'd rather see destroyed than fall into the wrong hands.
S201 3y ago
> right in front of ultra short timeouts everywhere > If only I could meet the people who make these decisions in person... For what it's worth, I was once forced to implement a half hour auto-logout on a website that could hardly be considered as containing sensitive data because an external pentest firm flagged the lack of a short timeout as an issue. The only way we could show clients a passing pentest was to comply with all of the findings. We all knew it was stupid but management gave us no choice but to implement it.
- erhaetherth 3y ago
  Hah..you just reminded of me of something I implemented at my old company. We had a similarly short timeout, so I put in a 'heartbeat' that would refresh the timeout if you move your mouse or do anything.
- Nifty3929 3y ago
  "management gave us no choice" - Would you have done differently? "The only way we could show clients a passing pentest..."
  - cnity 3y ago
    Push back on the pentest firm and explain reasoning, rather than bubbling pointless requirements to the engineers.
    - Kalium 3y ago
      That might work if your company hired the pen testers, it's a lot less likely to work if they were hired by a client. In the latter case, the overhead of all the required explanation and smoothing of ruffled feathers for the client likely costs a lot more than implementing the stupid timeout in the first place. Pen testers are often very resistant to pushback. They get it a lot, and usually on things that are real concerns.
      - cnity 3y ago
BLKNSLVR 3y ago
Even MS Remote Desktop doesn't allow it. Why do they think password managers exist?
- themoonisachees 3y ago
  Mstsc doesn't allow it because the login screen for windows doesn't have copy-paste. It's not that it has been disabled, it's that it was never programmed to have something in the clipboard before logging in. Still, they probably could load the thing first easily, but it's Microsoft we're talking about.
- deleted 3y ago
  [deleted]

twobitshifter 3y ago

Here was a dumb one from me the other day. - I had to use login.gov - My password manager had a saved login for it, I didn’t remember it, but it worked - Then the site asked me for an authenticator app code. I checked my authenticator apps and there was nothing there for login.gov. - There’s a login another way button so I click that and the other way is use the authenticator app! - I click what if I can’t get my code? - It says I must DELETE my account. - I click to delete my account and it sends me an email. - The email says to wait 24 hours for another account deletion email. - 24 hours later I get an email that allows me to delete my account. What was in the account? I have no idea, but it seems that it must be sensitive for some uses of the login. But if it’s sensitive and important why am I able to delete the account, the most destructive thing? Why is an email enough for me to delete it but not enough for me to get an auth code?

wccrawford 3y ago
I would guess that the 24 hour delay is to allow the real owner of the account a change to cancel the delete if someone tries to mess with their account. That said, you're right. This is really weird.
- erhaetherth 3y ago
  How is the real owner going to know to cancel the delete? Did it send them...an email?
m3047 3y ago
It's been too long and I don't clearly remember, but I think I had to use login.gov to establish an account for mumble. There was an option to print out a onetime pad (for 2FA); I chose it just for kicks. Haven't used it but I have it on file "against the day" I lose my normal second factor.
bobbylarrybobby 3y ago
While an attacker being able to use just a password (and no 2fa) to delete someone else’s account is pretty bad, stealing information from their account may well be worse. There is a lot of personal information that I have that I'd rather see destroyed than fall into the wrong hands.

S201 3y ago

> right in front of ultra short timeouts everywhere > If only I could meet the people who make these decisions in person... For what it's worth, I was once forced to implement a half hour auto-logout on a website that could hardly be considered as containing sensitive data because an external pentest firm flagged the lack of a short timeout as an issue. The only way we could show clients a passing pentest was to comply with all of the findings. We all knew it was stupid but management gave us no choice but to implement it.

erhaetherth 3y ago
Hah..you just reminded of me of something I implemented at my old company. We had a similarly short timeout, so I put in a 'heartbeat' that would refresh the timeout if you move your mouse or do anything.
Nifty3929 3y ago
"management gave us no choice" - Would you have done differently? "The only way we could show clients a passing pentest..."
- cnity 3y ago
  Push back on the pentest firm and explain reasoning, rather than bubbling pointless requirements to the engineers.
  - Kalium 3y ago
    That might work if your company hired the pen testers, it's a lot less likely to work if they were hired by a client. In the latter case, the overhead of all the required explanation and smoothing of ruffled feathers for the client likely costs a lot more than implementing the stupid timeout in the first place. Pen testers are often very resistant to pushback. They get it a lot, and usually on things that are real concerns.
    - cnity 3y ago

BLKNSLVR 3y ago

Even MS Remote Desktop doesn't allow it. Why do they think password managers exist?

themoonisachees 3y ago
Mstsc doesn't allow it because the login screen for windows doesn't have copy-paste. It's not that it has been disabled, it's that it was never programmed to have something in the clipboard before logging in. Still, they probably could load the thing first easily, but it's Microsoft we're talking about.
deleted 3y ago
[deleted]