5 ms·

I welcome this extension as I, too, hate when sites prevent me from pasting (eg. to confirm my account and routing number, email address, etc). It fucks with my

I welcome this extension as I, too, hate when sites prevent me from pasting (eg. to confirm my account and routing number, email address, etc). It fucks with my password manager and of course it's annoying when intricate password rules are implemented to counter the use of weak passwords. BUT. Yeah there's always a but. But. I have implemented these exact security measures into web applications. I've been handed the requirements and I implemented them. I asked my client why we had to do this, when "everyone" knows that this stuff is terrible user-experience and can backfire spectacularly for security (the same people who would memorize a shitty password and use it everywhere, will now write their expiring, "strong", impossible-to-remember password on a sticky note or save it to a text file or spreadsheet called 'passwords.txt' on their Desktop). The answer is: we have to, for compliance. To pass a security audit. To prove to some major client or insurance company that we have a number of industry-standard measures in place to improve security. Unfortunately, your bank does not care about the 2% of us using password managers. Everyone else is still memorizing passwords, forgetting them, and making jokes about it like it's 2003.

hartator 3y ago
> The answer is: we have to, for compliance. Do they? I don’t remember seeing any compliance requirements you can’t reasonably push back. This is just overzealous compliance consultants meeting a team that doesn’t really care about their users. People never really question anything.
- alex3305 3y ago
  > Do they? Probably not. In my experience most standards are pretty broadly defined with hardly any technical requirements. For instance in ISO 27001 it states that you should create awareness in your organisation about information security. A very minimal way is to send a mass email to everyone in the organisation or hang up posters in the office. But I also spoke to someone that was determined that a half day security awareness training was minimally required.
  - PH95VuimJjqBqy 3y ago
    As someone who has worked in both PCI and PHI environments (and by extension PII), often times these aren't actually about compliance but about someone's interpretation of compliance. What tends to happen is that auditors aren't going to tell you not to do something you don't have to, they're going to tell you to do to the things you must. Then the ones going "above and beyond" become convinced they're great at this compliance thing and others who don't do it are mistaken. A perfect example is that PCI compliances requires firewalls but I know of a CISO that insisted on hardware level separation between networks with no way to bridge between them. The amount of pain and harm he did to that company cannot be overstated but he was convinced it was a requirement of PCI-DSS.
fredcy 3y ago
Our PCI-compliance audit dings us for not disabling autocomplete on the login form fields. That's not the same as disabling paste, but heading that direction. For personal use I just abandon any site that won't let me use my password manager (Bitwarden).
- kalupa 3y ago
  you just abandon banking websites?
  - toonalfrink 3y ago
    Not that hard nowadays to switch to a decent developer-led neobank
adolph 3y ago
You know that if paste-blocking countermeasures get too popular then the same sites will just implement virtual keyboards. But I guess if that is to easy for folks with touchscreens then next will be the virtual mouse to click the virtual keyboard. Maybe add a randomly changing acceleration factor to the mouse to tell human and computer apart.
- oldandboring 3y ago
  > You know that if paste-blocking countermeasures get too popular Considering we've had password managers for ~20 years and most people have no idea they exist, you'll forgive me if I'm not concerned about paste-blocking taking off in popularity.

hartator 3y ago

> The answer is: we have to, for compliance. Do they? I don’t remember seeing any compliance requirements you can’t reasonably push back. This is just overzealous compliance consultants meeting a team that doesn’t really care about their users. People never really question anything.

alex3305 3y ago
> Do they? Probably not. In my experience most standards are pretty broadly defined with hardly any technical requirements. For instance in ISO 27001 it states that you should create awareness in your organisation about information security. A very minimal way is to send a mass email to everyone in the organisation or hang up posters in the office. But I also spoke to someone that was determined that a half day security awareness training was minimally required.
- PH95VuimJjqBqy 3y ago
  As someone who has worked in both PCI and PHI environments (and by extension PII), often times these aren't actually about compliance but about someone's interpretation of compliance. What tends to happen is that auditors aren't going to tell you not to do something you don't have to, they're going to tell you to do to the things you must. Then the ones going "above and beyond" become convinced they're great at this compliance thing and others who don't do it are mistaken. A perfect example is that PCI compliances requires firewalls but I know of a CISO that insisted on hardware level separation between networks with no way to bridge between them. The amount of pain and harm he did to that company cannot be overstated but he was convinced it was a requirement of PCI-DSS.

fredcy 3y ago

Our PCI-compliance audit dings us for not disabling autocomplete on the login form fields. That's not the same as disabling paste, but heading that direction. For personal use I just abandon any site that won't let me use my password manager (Bitwarden).

kalupa 3y ago
you just abandon banking websites?
- toonalfrink 3y ago
  Not that hard nowadays to switch to a decent developer-led neobank

adolph 3y ago

You know that if paste-blocking countermeasures get too popular then the same sites will just implement virtual keyboards. But I guess if that is to easy for folks with touchscreens then next will be the virtual mouse to click the virtual keyboard. Maybe add a randomly changing acceleration factor to the mouse to tell human and computer apart.

oldandboring 3y ago
> You know that if paste-blocking countermeasures get too popular Considering we've had password managers for ~20 years and most people have no idea they exist, you'll forgive me if I'm not concerned about paste-blocking taking off in popularity.