5 ms·
Far worse are websites like Battle.net that hijack the onpaste events to prevent pasting passwords. Hijacking keyboard shortcuts may cause inconveniences but pr
by emsy 13y ago
Far worse are websites like Battle.net that hijack the onpaste events to prevent pasting passwords. Hijacking keyboard shortcuts may cause inconveniences but prohibiting password pasting is a security flaw.
- 67726e 13y agoDo tell, how is that a "security flaw"?
- mnutt 13y agoIt could be that some people use password managers that require pasting. (though many don't) It could lead to people using passwords that are easier to remember if their password manager doesn't work.
- 67726e 13y agoI guess that is something of a double-edged sword then. You might force someone to use a weaker password, but then hopefully they wouldn't be keeping it in a place where they could simply copy/paste it. This really starts to delve into the whole "security is a gradient with tradeoffs" situation.
- aestra 13y ago>hopefully they wouldn't be keeping it in a place where they could simply copy/paste it. ??? Passwords can be simple copy/pasted from. Encrypted files can be simply copy/pasted from.
- 67726e 13y agoI'm assuming in this scenario that they would be keeping passwords in a plaintext file. If they kept passwords in an encrypted file, wouldn't they need to decrypt it? Wouldn't you presumably have a strong password to decrypt it? Where is that kept? How strong must one's password be when that password is keeping other passwords secure? If they can remember that password, why can they not remember others?
- maxerickson 13y agoRemembering 1 password is easier than remembering dozens of them. Reusing passwords is not a great idea, so dozens of passwords is a real concern. It's also the case that disabling paste doesn't do anything to stop a user from storing their passwords in an unencrypted file.
- dllthomas 13y agoBecause remembering one strong password is way easier than remembering 50 strong passwords.
- dllthomas 13y agoHm, this set me wondering how much risk there is passing the passwords through the copy-paste mechanism itself. Probably not terribly much more than passing through the keyboard and IO subsystems, though. Still, I know with X selection buffers, when data is requested the application it's requested from can run arbitrary code to generate (or check!) it and is passed the window-id requesting[0]. It seems like a password manager could make use of this to implement an ACL and lock things down tighter - do any do this? [0]: http://tronche.com/gui/x/icccm/sec-2.html#s-2.4 http://tronche.com/gui/x/icccm/sec-2.html#s-2.4
- maxerickson 13y agoA lot of people that use password managers don't know their passwords (I only know a few of mine). Maybe calling it a flaw is too severe, but it isn't doing those folks any good.
- 67726e 13y agoI'm curious as to how that would affect a password manager? I was always under the impression that they would directly manipulate the DOM (or perhaps alter the outgoing request)?
- aestra 13y agoNo. Here is a workflow: 1) Download keypass. 2) generate random password (however you do that...) 3) copy password into web form. 4) copy passwords into keypass and save. for logging in: 1) open keypass 2) copy password 3) paste into webform. Typing the passwords leaves room for errors. Truly random passwords are copied and pasted. Words are typed.
- Fuxy 13y agoBetter yet what's the point of doing that anyway a pasted password is likely to be more complex (read as secure) than a regular one.
- hyperpape 13y agoAnything that makes passwords harder to do right without simultaneously blocking some attack worth caring about is bad for security. Two of the biggest problems in security are that it's hard to do things the right way and that people just don't understand it. Whether you want to call it a "security flaw" is not obviously an important question.
- blueskin_ 13y agoIt discourages password manager use.
- aestra 13y agoI am not sure why you are getting downvoted for asking a simple question. It could be a security flaw because you discourage using passwords that are truly randomly generated.
- johndoeee 13y agoI wanted to use a random password, unable to paste it, I pasted it into my firstname field and just typed while reading it from there. Anyways, I forgot to remove it again so now my first name is <firstname><oldpassword>. You can't change your name after your account has been created.
- id 13y agoPayPal is also doing this in their "change password" form.
- chill1 13y agoPreventing users from pasting their passwords is quite irritating. I don't even understand the idea behind it. Most likely some developer saw a non-technical user copying/pasting from a plain-text password file, and "had a great idea" to discourage that kind of behavior. To get around sites that do this, I inspect the HTML and add my password via the value="" attribute on the input element.
- blueskin_ 13y agoI use KeePass' autotype.
- blueskin_ 13y agoKeePass has a great autotype feature that perfectly bypasses that by simulating real keyboard input. When it comes to anti-clipboard, I really hate sites that make you enter your email address twice (Which is retarded anyway; WHY THE FUCK would I not know/check what I am typing?; it's a cleartext field, you might as well have 2 fields for everything up to first name FFS...), then stop you copying emailfield1 to emailfield2. Fortunately, most still let me click and drag from 1 to 2.
- dllthomas 13y agoWhat I really hate is accounting ledgers that make me enter things it two places. Geeeze. The reason email is special is because if that's wrong there's often no good way to fix it (and certainly no way to notify you). Whether that's sufficient motivation is a matter of judgement, but it's clearly different than first name.