4 ms·

Overly controlling code like this also prevents copy/paste. For example, I have had to manually type passwords from my password manager, because a form refused

Overly controlling code like this also prevents copy/paste. For example, I have had to manually type passwords from my password manager, because a form refused to let me paste from the clipboard.

pquki4 3y ago
And too many websites force you to type the 2FA code, like, actually hitting the keys one after another, instead of allowing pasting the code despite the fact that they send the 6 digits to your email.
- RulerOf 3y ago
  The most annoying form of that was actually featured in the related section of TFA: six individual input boxes.^1 I've seen some of these that magically work with paste, but plenty that don't. [1]: https://shkspr.mobi/blog/2023/10/firefox-might-remember-old-2fa-logins/ https://shkspr.mobi/blog/2023/10/firefox-might-remember-old-...
- rob74 3y ago
  ...and despite the fact that it's a single use code that expires after a few minutes. I mean, a password in the clipboard could conceivably be a security risk if you leave your computer unlocked, but a 2FA code?
NovemberWhiskey 3y ago
Developers who think they're doing the world a security favor by inhibiting paste into password boxes have a special place in hell.
- rob74 3y ago
  Maybe the developers even know better, but were forced to do it by project managers (or other management)? Because this sounds like just the kind of "security issue" a manager could get hung up on...
  - pc86 3y ago
    This will be an unpopular opinion but part of your job as a good developer is being able to explain to your boss why this is an asinine thing to do, and convince them otherwise. If you're both powerless to make a decision as small as this and unable to convince even a single person above you to back you up on it you're not a very effective engineer.
    - danaris 3y ago
      That basically says "your skill as a good developer depends on your boss being somewhat reasonable." Not everyone's boss is even a little bit reasonable. You might be both a very skilled engineer and capable of explaining things very clearly and persuasively, but communication always takes two (or more) parties, and both those parties have to be approaching that communication in good faith in order for the actual skills of communication to really matter.
      - pc86 3y ago
        There's this trope that most bosses are this curious mix of idiot, sadist, and fat cat blueblood completely incapable of reason, who produces nothing of value, and just sits around thinking of ways to make things harder on the engineers. Most people are reasonable, including people who happen to be managers. Most people will listen to you if you make informed, persuasive arguments. And even when they don't, most people will be able to articulate to you a perfectly valid reason why the thing you want to do can't happen, or can't happen yet.
        hunter2_ 3y ago
        As a thought experiment, playing devil's advocate in a way, suppose the boss tries to be reasonable and ends up telling the developer "you make a good point, and I would support it, but my hands are tied because x." Presumably there is some value of x here that, while terrible for UX/a11y, actually exists in some fashion when it comes to using the clipboard for passwords. Maybe the fact that all apps can arbitrarily read from the clipboard, and people tend to be too lazy to copy a non-secret to the clipboard between pasting a secret and opening a sketchy app? Recent versions of Android toss up a toast notification saying something like "<app> has pasted from the clipboard" when an app does so, and I've seen it for no apparent reason in some apps -- usually apps associated with IoT junk, but sometimes even apps that ought to be reputable. I'm not normally a fan of ecosystem lock-in, but using Google products as my password manager, browser, and mobile OS means I very rarely have to use my clipboard for passwords, which is a good feeling. Unlike a third-party password manager with a great browser extension could offer, this ensures seamless autofill with most mobile apps nowadays, too.
enobrev 3y ago
I see this problem on bank account forms all the time, where they need you to type and confirm your bank account number for things like direct deposit or ACH payments. I'm more likely to get it wrong twice than I am if I just copy and paste it from my actual bank account website once.
- pc86 3y ago
  I've seen it here more than with 2FA forms. So you're doing enough routing number verification to tell me that what I just typed in is Bank of America (I know it is) but you still make me manually type it - twice - just to increase my odds of making a mistake?
vultour 3y ago
When a website refuses to let me paste my password I open DevTools, manually add a value="password" attribute on the input, and submit the form. I don't know what kind of moron makes these decisions, but thanks, now everybody can see my password in plaintext while I'm putting it in.
Karellen 3y ago
Check if your password manager has a "perform auto-type" (or similar) function, where it can send keyboard events to another window. That way your browser (or whatever app) doesn't have to support paste to work.

Overly controlling code like this also prevents copy/paste. For example, I have had to manually type passwords from my password manager, because a form refused to let me paste from the clipboard.

pquki4 3y ago

And too many websites force you to type the 2FA code, like, actually hitting the keys one after another, instead of allowing pasting the code despite the fact that they send the 6 digits to your email.

RulerOf 3y ago
The most annoying form of that was actually featured in the related section of TFA: six individual input boxes.^1 I've seen some of these that magically work with paste, but plenty that don't. [1]: https://shkspr.mobi/blog/2023/10/firefox-might-remember-old-2fa-logins/ https://shkspr.mobi/blog/2023/10/firefox-might-remember-old-...
rob74 3y ago
...and despite the fact that it's a single use code that expires after a few minutes. I mean, a password in the clipboard could conceivably be a security risk if you leave your computer unlocked, but a 2FA code?

NovemberWhiskey 3y ago

Developers who think they're doing the world a security favor by inhibiting paste into password boxes have a special place in hell.

rob74 3y ago
Maybe the developers even know better, but were forced to do it by project managers (or other management)? Because this sounds like just the kind of "security issue" a manager could get hung up on...
- pc86 3y ago
  This will be an unpopular opinion but part of your job as a good developer is being able to explain to your boss why this is an asinine thing to do, and convince them otherwise. If you're both powerless to make a decision as small as this and unable to convince even a single person above you to back you up on it you're not a very effective engineer.
  - danaris 3y ago
    That basically says "your skill as a good developer depends on your boss being somewhat reasonable." Not everyone's boss is even a little bit reasonable. You might be both a very skilled engineer and capable of explaining things very clearly and persuasively, but communication always takes two (or more) parties, and both those parties have to be approaching that communication in good faith in order for the actual skills of communication to really matter.
    - pc86 3y ago
      There's this trope that most bosses are this curious mix of idiot, sadist, and fat cat blueblood completely incapable of reason, who produces nothing of value, and just sits around thinking of ways to make things harder on the engineers. Most people are reasonable, including people who happen to be managers. Most people will listen to you if you make informed, persuasive arguments. And even when they don't, most people will be able to articulate to you a perfectly valid reason why the thing you want to do can't happen, or can't happen yet.
      - hunter2_ 3y ago
        As a thought experiment, playing devil's advocate in a way, suppose the boss tries to be reasonable and ends up telling the developer "you make a good point, and I would support it, but my hands are tied because x." Presumably there is some value of x here that, while terrible for UX/a11y, actually exists in some fashion when it comes to using the clipboard for passwords. Maybe the fact that all apps can arbitrarily read from the clipboard, and people tend to be too lazy to copy a non-secret to the clipboard between pasting a secret and opening a sketchy app? Recent versions of Android toss up a toast notification saying something like "<app> has pasted from the clipboard" when an app does so, and I've seen it for no apparent reason in some apps -- usually apps associated with IoT junk, but sometimes even apps that ought to be reputable. I'm not normally a fan of ecosystem lock-in, but using Google products as my password manager, browser, and mobile OS means I very rarely have to use my clipboard for passwords, which is a good feeling. Unlike a third-party password manager with a great browser extension could offer, this ensures seamless autofill with most mobile apps nowadays, too.

enobrev 3y ago

I see this problem on bank account forms all the time, where they need you to type and confirm your bank account number for things like direct deposit or ACH payments. I'm more likely to get it wrong twice than I am if I just copy and paste it from my actual bank account website once.

pc86 3y ago
I've seen it here more than with 2FA forms. So you're doing enough routing number verification to tell me that what I just typed in is Bank of America (I know it is) but you still make me manually type it - twice - just to increase my odds of making a mistake?

vultour 3y ago

When a website refuses to let me paste my password I open DevTools, manually add a value="password" attribute on the input, and submit the form. I don't know what kind of moron makes these decisions, but thanks, now everybody can see my password in plaintext while I'm putting it in.

Karellen 3y ago

Check if your password manager has a "perform auto-type" (or similar) function, where it can send keyboard events to another window. That way your browser (or whatever app) doesn't have to support paste to work.