7 ms·

I especially like sites that disallow pasting into password fields.... Yes, that is apparently a thing, especially for banking or finance related sites (from my

I especially like sites that disallow pasting into password fields.... Yes, that is apparently a thing, especially for banking or finance related sites (from my experience)

yojo 2y ago
For a while, the login for TreasuryDirect (the gov site for buying US bonds) disabled paste and typing! It required you to click out your password on an onscreen keyboard. I pity the folks who don’t know how to use dev tools.
- commandersaki 2y ago
  Good on 'em for doing a complete 180 on that. Bank of Melbourne has stated that using a Password Manager is a violation of their Terms of Service (as people have complained about the non-pasteable/autofill fields).
  - magnetowasright 2y ago
    Last time I had the sincere displeasure of having to use bank of Melbourne, their password rules included that you couldn't have repeated letters, so if you were trying to use a passphrase like correct-horse-battery-staple it would not allow the double r in correct or double t in battery. The rest of their password rules were abhorrent like all financial institutions but that one in particular irritated me to no end.
- nytesky 2y ago
  You buried the lead there: A required on-screen keyboard with RANDOM GENERATED LAYOUT.
  - jakub_g 2y ago
    For whomever is interested, IIRC, this requirement of random layout came up in late 2000/early 2010 due to: - keyloggers (safer to click instead of type instead -> on-screen keyboard then) - but then it turned out Internet Explorer had a bug which allowed attackers to read the mouse click events' X/Y coordinates in other windows which then could be mapped to the on-screen keyboard digits if the layout is predictable
  - brokenmachine 2y ago
    ING Bank Australia still does that. And it also makes my laptop's fan spin up for about 5 seconds on the page load or reload. No idea WTF they're doing - cryptomining? https://www.ing.com.au/securebanking/ https://www.ing.com.au/securebanking/ My password manager appears to type the access code successfully but you can't click on login until you click on the stupid keypad.
nerdjon 2y ago
I despise sites that disallow pasting into fields. Banks seem to really like to now allow you to paste direct deposit information, which is insane. I get that they likely are thinking, well we don't want you type it into the first field and copy it into the second. But I am copying it right from my bank's website, being forced to type it twice is just going to make it more likely I enter an error and I can guarantee you I am looking at that first field when I am typing the verification one.
- ryandrake 2y ago
  Why is this even a allowed by browsers? The web developer should not be able to disable pasting. Just like they should not be able to disable autofill, and other features that the user wants and has enabled. So many things web sites do that are counter to the user's expectation, where I think to myself: Why even have that lever?
  - brokenmachine 2y ago
    It all started with <blink> and it's been downhill ever since.
- kyleee 2y ago
  There is a force paste context menu in brave. Firefox should copy the feature as well, if they still have anyone who works on new features for the browser.
  - ziddoap 2y ago
    Firefox has had this feature for a long time. Set dom.event.clipboardevents.enabled to false in about:config.
    - jorvi 2y ago
      That is not the same. On Brave it is just a right click and then "force paste". Plus, I suspect that setting disables the buttons on sites that copy the entire field to your buffer.
cameronh90 2y ago
I've been working in finance for 15 years, and the amount of security theatre we're forced to do by various parties is monotonically increasing year by year. The way it works is you have a hundred government regulators around the world, full of underpaid bureaucrats straight out of school, who introduce vague, poorly thought out requirements. The consequences of non-compliance often being existential for the business: you can lose your license, your clients, and in some cases, your freedom. Next a bunch of lawyer/compliance-y types take those requirements from around the world and try to distil them down to a specific (but onerous) set of controls by interpreting the guidelines cautiously. Obviously all they care about is making sure that if you do get popped, you can claim you did everything in compliance with the regulations and you get to continue trading. Often these rules are transitive too, so you need to have some level of certainty that the other parties in your supply chain are also compliant, so independent auditors spring up to provide some third party accreditation. Your CFO sees this purely as a cost and doesn't want to pay much for it, so the pressure is to make this auditing as simple as possible, so their checklists become oriented around things they can easily check to demonstrate compliance with a particular control. So some original requirement like "it should not be possible to share passwords between multiple users" ends up being bastardised down the chain until the item on the checklist is "don't allow pasting into the password field". Obviously by this point, everyone's actually forgotten why that checklist item was created, so even if the original requirement disappears, the checklist item lives on, often, forever. It's only in rare, high profile circumstances where a previous requirement is explicitly and noisily repudiated that old items tend to disappear. Even then it can take years. I'm still having to fight back auditors asking for mandatory monthly password changes, for example, in a system that uses passkeys...
bruckie 2y ago
I'm a big fan of the "Don't mess with paste" bookmarklet that I got from this thread a while back: https://news.ycombinator.com/item?id=38014653 https://news.ycombinator.com/item?id=38014653 One click and I can paste anyway. Nyah nyah nyah nyah nyah nyah.
- kyleee 2y ago
  Brave has a ‘force paste’ option in the right click context menu, that way you don’t need an extension. Awesome feature
  - encom 2y ago
    Why is disabling paste even a thing that a website is allowed to do?
    - samatman 2y ago
      I'm aware of one case where it's a useful feature: the "type this name to delete" form on GitHub (found elsewhere as well). The purpose, which is to make sure the user knows what they're deleting permanently, is defeated if they can copy the end of the URL string and paste it straight in. Adding a bit of friction there is helpful. The actual answer to your question is more like "someone thought it was a good idea and now we're stuck with it", though. More browsers should offer a force paste in the context menu, because when said is done, it's my browser, and if I want to do something, I should be able to do it.
      - skydhash 2y ago
        > I'm aware of one case where it's a useful feature: the "type this name to delete" form on GitHub While I like the dialogue it’s only a step up over a confirmation dialog (forcing you to switch from clicking to typing). So disabling paste don’t add anything to that. I’d rather they have a trash section so I can undelete or force remove the project.
deleted 2y ago
[deleted]
graftak 2y ago
A less vicious but similarly dumb ‘ux/security’ measure is when the password being entered only registers after a key event fires while the field is in focus. An event that never occurs with password manager autocomplete, making the user add a random character and then remove it.
benced 2y ago
It's slower but out of spite I usually go into the console and remove the `onpaste="false"` nonsense from their markup.

I especially like sites that disallow pasting into password fields.... Yes, that is apparently a thing, especially for banking or finance related sites (from my experience)

yojo 2y ago

For a while, the login for TreasuryDirect (the gov site for buying US bonds) disabled paste and typing! It required you to click out your password on an onscreen keyboard. I pity the folks who don’t know how to use dev tools.

commandersaki 2y ago
Good on 'em for doing a complete 180 on that. Bank of Melbourne has stated that using a Password Manager is a violation of their Terms of Service (as people have complained about the non-pasteable/autofill fields).
- magnetowasright 2y ago
  Last time I had the sincere displeasure of having to use bank of Melbourne, their password rules included that you couldn't have repeated letters, so if you were trying to use a passphrase like correct-horse-battery-staple it would not allow the double r in correct or double t in battery. The rest of their password rules were abhorrent like all financial institutions but that one in particular irritated me to no end.
nytesky 2y ago
You buried the lead there: A required on-screen keyboard with RANDOM GENERATED LAYOUT.
- jakub_g 2y ago
  For whomever is interested, IIRC, this requirement of random layout came up in late 2000/early 2010 due to: - keyloggers (safer to click instead of type instead -> on-screen keyboard then) - but then it turned out Internet Explorer had a bug which allowed attackers to read the mouse click events' X/Y coordinates in other windows which then could be mapped to the on-screen keyboard digits if the layout is predictable
- brokenmachine 2y ago
  ING Bank Australia still does that. And it also makes my laptop's fan spin up for about 5 seconds on the page load or reload. No idea WTF they're doing - cryptomining? https://www.ing.com.au/securebanking/ https://www.ing.com.au/securebanking/ My password manager appears to type the access code successfully but you can't click on login until you click on the stupid keypad.

nerdjon 2y ago

I despise sites that disallow pasting into fields. Banks seem to really like to now allow you to paste direct deposit information, which is insane. I get that they likely are thinking, well we don't want you type it into the first field and copy it into the second. But I am copying it right from my bank's website, being forced to type it twice is just going to make it more likely I enter an error and I can guarantee you I am looking at that first field when I am typing the verification one.

ryandrake 2y ago
Why is this even a allowed by browsers? The web developer should not be able to disable pasting. Just like they should not be able to disable autofill, and other features that the user wants and has enabled. So many things web sites do that are counter to the user's expectation, where I think to myself: Why even have that lever?
- brokenmachine 2y ago
  It all started with <blink> and it's been downhill ever since.
kyleee 2y ago
There is a force paste context menu in brave. Firefox should copy the feature as well, if they still have anyone who works on new features for the browser.
- ziddoap 2y ago
  Firefox has had this feature for a long time. Set dom.event.clipboardevents.enabled to false in about:config.
  - jorvi 2y ago
    That is not the same. On Brave it is just a right click and then "force paste". Plus, I suspect that setting disables the buttons on sites that copy the entire field to your buffer.

cameronh90 2y ago

I've been working in finance for 15 years, and the amount of security theatre we're forced to do by various parties is monotonically increasing year by year. The way it works is you have a hundred government regulators around the world, full of underpaid bureaucrats straight out of school, who introduce vague, poorly thought out requirements. The consequences of non-compliance often being existential for the business: you can lose your license, your clients, and in some cases, your freedom. Next a bunch of lawyer/compliance-y types take those requirements from around the world and try to distil them down to a specific (but onerous) set of controls by interpreting the guidelines cautiously. Obviously all they care about is making sure that if you do get popped, you can claim you did everything in compliance with the regulations and you get to continue trading. Often these rules are transitive too, so you need to have some level of certainty that the other parties in your supply chain are also compliant, so independent auditors spring up to provide some third party accreditation. Your CFO sees this purely as a cost and doesn't want to pay much for it, so the pressure is to make this auditing as simple as possible, so their checklists become oriented around things they can easily check to demonstrate compliance with a particular control. So some original requirement like "it should not be possible to share passwords between multiple users" ends up being bastardised down the chain until the item on the checklist is "don't allow pasting into the password field". Obviously by this point, everyone's actually forgotten why that checklist item was created, so even if the original requirement disappears, the checklist item lives on, often, forever. It's only in rare, high profile circumstances where a previous requirement is explicitly and noisily repudiated that old items tend to disappear. Even then it can take years. I'm still having to fight back auditors asking for mandatory monthly password changes, for example, in a system that uses passkeys...

bruckie 2y ago

I'm a big fan of the "Don't mess with paste" bookmarklet that I got from this thread a while back: https://news.ycombinator.com/item?id=38014653 https://news.ycombinator.com/item?id=38014653 One click and I can paste anyway. Nyah nyah nyah nyah nyah nyah.

kyleee 2y ago
Brave has a ‘force paste’ option in the right click context menu, that way you don’t need an extension. Awesome feature
- encom 2y ago
  Why is disabling paste even a thing that a website is allowed to do?
  - samatman 2y ago
    I'm aware of one case where it's a useful feature: the "type this name to delete" form on GitHub (found elsewhere as well). The purpose, which is to make sure the user knows what they're deleting permanently, is defeated if they can copy the end of the URL string and paste it straight in. Adding a bit of friction there is helpful. The actual answer to your question is more like "someone thought it was a good idea and now we're stuck with it", though. More browsers should offer a force paste in the context menu, because when said is done, it's my browser, and if I want to do something, I should be able to do it.
    - skydhash 2y ago
      > I'm aware of one case where it's a useful feature: the "type this name to delete" form on GitHub While I like the dialogue it’s only a step up over a confirmation dialog (forcing you to switch from clicking to typing). So disabling paste don’t add anything to that. I’d rather they have a trash section so I can undelete or force remove the project.

deleted 2y ago

[deleted]

graftak 2y ago

A less vicious but similarly dumb ‘ux/security’ measure is when the password being entered only registers after a key event fires while the field is in focus. An event that never occurs with password manager autocomplete, making the user add a random character and then remove it.

benced 2y ago

It's slower but out of spite I usually go into the console and remove the `onpaste="false"` nonsense from their markup.