5 ms·

And let me paste. Especially if you're going to insist on doing it by SMS (also though please don't) then surely you should know that both Android and iOS make

by OJFord 3y ago

And let me paste. Especially if you're going to insist on doing it by SMS (also though please don't) then surely you should know that both Android and iOS make it easy and prominent to copy the code to clipboard...

trollbridge 3y ago
One of my favourite features in Brave is “Force Paste”.
- puttycat 3y ago
  In Firefox AFAIK right-click always opens the menu with a Paste option.
  - echoangle 3y ago
    But that’s the same as pressing the paste shortcut. I guess the force option emulates keypresses or something like that to always allow paste, which the right click option of Firefox doesn’t do.
    - HeatrayEnjoyer 3y ago
      FF has force paste now too
  - kps 3y ago
    Also, in Firefox SHIFT+right-click always opens the menu, even when the site has tried to hijack right-click.
simonjgreen 3y ago
I’m a fan of the extension ‘Don’t f** with paste’
- gruez 3y ago
  I don't often see websites blocking paste on OTP code fields. What I do see often is websites breaking up the OTP field into n separate input fields, and having some code that auto-switches between the input fields as you type them. However, the auto-switching code doesn't handle pastes, so if you try to paste the entire code only the first digit gets entered. ‘Don’t f* with paste’ doesn't help with that.
  - OJFord 3y ago
    Ugh yeah, honestly if paste is disabled because that was the most effort they were going to put in to 'fixing' that I'll excuse it. Better to not even appear briefly like it might work!
  - G1N 3y ago
    I’ve to do this with OTP codes at work as well. Reimplementing paste here I’d say is pretty trivial (though you have to add Yet Another Event Listener) but I’d agree with the general sentiment here to just not overcomplicate it at all if possible
  - cgriswald 3y ago
    These are also terrible if you need to go back because you mistyped. Shift+Tab brings your cursor back to correct it but their code pushes the cursor right back into the next empty box. (And they do this with a lot more than just OTP.)
- aitchnyu 3y ago
  I recently learned we can drag password from any text or Bitwarden to the password fields without triggering paste event.
  - SSLy 3y ago
    some shit tier sites coded by obstinate assholes do not let you proceed to submit the form without seeing keyboard events
lxgr 3y ago
Or my favorite variant: Allow paste, but require at least one character type event before allowing submission (because otherwise the password/OTP field must be empty, right?)
- progbits 3y ago
  Both of these are stupid but we should blame the OS/browser, there is no reason the site should be able to tell the difference or block pasting in the first place.
  - lxgr 3y ago
    Presumably browsers could replace a paste with n “key down” and “key up” events, but I bet that causes other issues elsewhere and doesn’t seem like the right solution. Ultimately, misguided developers or PMs will always find a way to make our lives harder if they set their mind to it; let’s not make it an arms race. That said, for password managers and known-bad sites, your proposal sounds tempting!
    - kps 3y ago
      > Presumably browsers could replace a paste with n “key down” and “key up” events Or a single text input event. Key events will get you nowhere in the presence of CJK IMEs, for instance.
      - lxgr 3y ago
        You know that, but do the developers of broken password input fields?
        kps 3y ago
        The question is whether I know it despite not being a front-end developer, or because of not being a front-end developer. (Around 8–10 years ago I worked on keyboard input for ChromeOS, and way too much of it was trying to emulate 1995 Windows Netscape so that most sites would mostly work.)
elros 3y ago
Also copying from my iPhone and pasting into my Mac is so practical it feels like straight up science fiction
NoMoreNicksLeft 3y ago
There are a few sites I've found over the years which won't allow this for password fields. They nag and nag that you need strong passwords... great, mine's 100 characters of gibberish in my password manager. Then when it comes time to paste it, they've got that disabled. You know, for security purposes.
- thedanbob 3y ago
  I once had an account with a bank whose website did this, but only for the change password form. Which wouldn't have been too bad except they also had a "force users to change their password every X months" policy. I was so annoyed that I opened dev tools and used the console to circumvent their stupid javascript every time.
  - aembleton 3y ago
    I think I'd switch banks over this
    - NoMoreNicksLeft 3y ago
      Banks are guilty of worse, but they're difficult to switch. And how do you know that the next one will be any better? Smaller banks in particular seem to be using some whitebox software title to do their online banking, so you might go to all the trouble only to discover the exact same. How many times can you switch up your direct deposit before HR/payroll gets annoyed with you?
hunter2_ 3y ago
> Android and iOS make it easy and prominent to copy the code to clipboard I've noticed some inconsistency on Android: many, but not all, SMS notifications from Google Messages (Pixel) contain a "Copy code" button when the message has an OTP. I wonder if there's some kind of heuristic or list of known phrases/senders baked into the app, always lagging behind as things evolve. OTP messages from non-A-list services have only the "Reply" / "Mark as read" buttons on the notification a substantial portion of the time, at which point one can type the code manually or copy the whole message after opening it.
- mmis1000 3y ago
  > I wonder if there's some kind of heuristic or list of known phrases/senders baked into the app, It's actually rely on specific message format. And it's a function of google message app instead of system wide function. Although the pattern isn't documented anywhere. https://blog.google/products/messages/five-new-features-try-messages/ https://blog.google/products/messages/five-new-features-try-...
appplication 3y ago
Tangential, but are there any really good integrations with authenticator apps/autofill like the way iPhone autofills SMS codes? I know SMS is less secure but the UX of autofill on e.g. iPhone at least is so much nicer than having to pop out of my browser/app, open an authenticator app etc.

by OJFord 3y ago

trollbridge 3y ago

One of my favourite features in Brave is “Force Paste”.

puttycat 3y ago
In Firefox AFAIK right-click always opens the menu with a Paste option.
- echoangle 3y ago
  But that’s the same as pressing the paste shortcut. I guess the force option emulates keypresses or something like that to always allow paste, which the right click option of Firefox doesn’t do.
  - HeatrayEnjoyer 3y ago
    FF has force paste now too
- kps 3y ago
  Also, in Firefox SHIFT+right-click always opens the menu, even when the site has tried to hijack right-click.

simonjgreen 3y ago

I’m a fan of the extension ‘Don’t f** with paste’

gruez 3y ago
I don't often see websites blocking paste on OTP code fields. What I do see often is websites breaking up the OTP field into n separate input fields, and having some code that auto-switches between the input fields as you type them. However, the auto-switching code doesn't handle pastes, so if you try to paste the entire code only the first digit gets entered. ‘Don’t f* with paste’ doesn't help with that.
- OJFord 3y ago
  Ugh yeah, honestly if paste is disabled because that was the most effort they were going to put in to 'fixing' that I'll excuse it. Better to not even appear briefly like it might work!
- G1N 3y ago
  I’ve to do this with OTP codes at work as well. Reimplementing paste here I’d say is pretty trivial (though you have to add Yet Another Event Listener) but I’d agree with the general sentiment here to just not overcomplicate it at all if possible
- cgriswald 3y ago
  These are also terrible if you need to go back because you mistyped. Shift+Tab brings your cursor back to correct it but their code pushes the cursor right back into the next empty box. (And they do this with a lot more than just OTP.)
aitchnyu 3y ago
I recently learned we can drag password from any text or Bitwarden to the password fields without triggering paste event.
- SSLy 3y ago
  some shit tier sites coded by obstinate assholes do not let you proceed to submit the form without seeing keyboard events

lxgr 3y ago

Or my favorite variant: Allow paste, but require at least one character type event before allowing submission (because otherwise the password/OTP field must be empty, right?)

progbits 3y ago
Both of these are stupid but we should blame the OS/browser, there is no reason the site should be able to tell the difference or block pasting in the first place.
- lxgr 3y ago
  Presumably browsers could replace a paste with n “key down” and “key up” events, but I bet that causes other issues elsewhere and doesn’t seem like the right solution. Ultimately, misguided developers or PMs will always find a way to make our lives harder if they set their mind to it; let’s not make it an arms race. That said, for password managers and known-bad sites, your proposal sounds tempting!
  - kps 3y ago
    > Presumably browsers could replace a paste with n “key down” and “key up” events Or a single text input event. Key events will get you nowhere in the presence of CJK IMEs, for instance.
    - lxgr 3y ago
      You know that, but do the developers of broken password input fields?
      - kps 3y ago
        The question is whether I know it despite not being a front-end developer, or because of not being a front-end developer. (Around 8–10 years ago I worked on keyboard input for ChromeOS, and way too much of it was trying to emulate 1995 Windows Netscape so that most sites would mostly work.)

elros 3y ago

Also copying from my iPhone and pasting into my Mac is so practical it feels like straight up science fiction

NoMoreNicksLeft 3y ago

There are a few sites I've found over the years which won't allow this for password fields. They nag and nag that you need strong passwords... great, mine's 100 characters of gibberish in my password manager. Then when it comes time to paste it, they've got that disabled. You know, for security purposes.

thedanbob 3y ago
I once had an account with a bank whose website did this, but only for the change password form. Which wouldn't have been too bad except they also had a "force users to change their password every X months" policy. I was so annoyed that I opened dev tools and used the console to circumvent their stupid javascript every time.
- aembleton 3y ago
  I think I'd switch banks over this
  - NoMoreNicksLeft 3y ago
    Banks are guilty of worse, but they're difficult to switch. And how do you know that the next one will be any better? Smaller banks in particular seem to be using some whitebox software title to do their online banking, so you might go to all the trouble only to discover the exact same. How many times can you switch up your direct deposit before HR/payroll gets annoyed with you?

hunter2_ 3y ago

> Android and iOS make it easy and prominent to copy the code to clipboard I've noticed some inconsistency on Android: many, but not all, SMS notifications from Google Messages (Pixel) contain a "Copy code" button when the message has an OTP. I wonder if there's some kind of heuristic or list of known phrases/senders baked into the app, always lagging behind as things evolve. OTP messages from non-A-list services have only the "Reply" / "Mark as read" buttons on the notification a substantial portion of the time, at which point one can type the code manually or copy the whole message after opening it.

mmis1000 3y ago
> I wonder if there's some kind of heuristic or list of known phrases/senders baked into the app, It's actually rely on specific message format. And it's a function of google message app instead of system wide function. Although the pattern isn't documented anywhere. https://blog.google/products/messages/five-new-features-try-messages/ https://blog.google/products/messages/five-new-features-try-...

appplication 3y ago

Tangential, but are there any really good integrations with authenticator apps/autofill like the way iPhone autofills SMS codes? I know SMS is less secure but the UX of autofill on e.g. iPhone at least is so much nicer than having to pop out of my browser/app, open an authenticator app etc.