18 ms·
We'd lose our security certificate if we allowed pasting
- pjc50 12y agoAlmost all big companies handle security on this kind of cargo-cult basis, because it's easier than finding someone who understands security and letting them overrule stupid ideas.
- nraynaud 12y agomaybe this loud PR thing will go up to the people in charge and stuff could be actually resolved at the root? Or maybe it will just be forbidden to tweet about internal policies in the future for security reasons, NSA cover style.
- higherpurpose 12y agoI was hoping the Target CEO firing/resignation due to security issues would spark a little bit of security interest from other companies, too.
- danpat 12y agoPut yourself in their shoes though. The people at the top don't really understand security, other than the vague "only the right people should have access to stuff" requirement. I think the problem is that the people in charge of making decisions are gun-shy. Because of their inability to properly evaluate the security itself, it's also very difficult for them to properly evaluate people telling them what the security system should look like, and they've been burned by bad decisions in the past, so they take the "lalalala do nothing" approach and hope for the best. From their point of view, it's a perfectly reasonable approach to the problem.
- jaredmcateer 12y agoPCI compliance requires we change our login passwords every two months. This to me seems to just encourage users to create insecure passwords and sticky notes with them written down somewhere in/on their desk.
- quchen 12y agoBefore laughing at how stupid this is, remember that your debit card is secured by a password that consists of exactly four decimal digits. I really wonder when this is finally going to change, but I hear some futuristic banks allow up to six digits already.
- morsch 12y agoIt's secured by a four digit password and self destruction after three consecutive invalid PIN entries. Which is plenty secure against brute force. Or is that just the way it works around here?
- eyko 12y agoUnless you buy online, in which case you just need the "last 3 digits on the back of your card".
- nraynaud 12y agoit's not a password, and it doesn't give the same insurance. There were some proposal of at home card readers in the 2000, but it never got very far, it was not really practical to secure either. I think the current trend of scratch credit card could be onto something for online buying, it's a temporary credit card number valid just for a few hours, and then it's deleted from the bank system.
- raesene3 12y agoThat's different to the PIN. CVV is for cardholder not present transactions, PIN is for one's where you're there. Also CVV needs the 16 digit card number, card holder name and expiry as well.. I'd almost guarantee that trying to brute-force a CVV number will get your card blocked real fast.
- smackfu 12y agoI got an email from my credit card after a single CVV failure, because the guy at the Apple store entered it wrong.
- DomBlack 12y agoIt always concerns me when big companies like this do weird things when it comes to passwords. Why do banks for instance have stupid password requirements; max lengths, disallowing certain characters, etc. Surely if they are hashing the passwords in any form then it doesn't matter how long the password is or what characters it contains. I understand perhaps the view is some people are not good at remembering passwords and so would forget a complicated password - but they are unlikely to use a long password or special characters if that's the case. Or am I just missing something major here?
- nodata 12y agoWhat if the password is one character long?
- bsilvereagle 12y agoDomBlack is referring to max length. For example several banks limit you to a 12 character long password and then don't allow special characters.
- danpalmer 12y agoIn the 1980s I don't think hashing passwords was common, it would have taken too much processing power, and the database fields on the mainframe don't support weird characters or a length of more than 8 characters. I wish this wasn't the case, but these systems are so old behind the scenes, that lots of it simply can't be changed without massive re-engineering. I have friends that work for a company who transfer COBOL applications from mainframes to JVM COBOL running on standard servers, it's a massive task, and takes years and lots of money.
- crbaker 12y agoIt will take these organisation years and lots of money to rebuild their reputations when their security malpractices catch up with them.
- 12y ago
- fdej 12y agoThey probably hired the same security consultant as my bank, which requires your online password to be exactly six characters long. My hypothesis is that this is a technical limitation due to the password being stored as a char(6) in their database.
- dougedey 12y agoMy bank (TD Canada) used to have this policy. Luckily it changed. However, they didn't tell me (or anyone) so I've been telling everyone I know to update their password to be longer.
- abdullahkhalids 12y agoThanks for the tip. I almost refused their online banking service because of the short password length.
- randlet 12y agoTD's password is still HORRIBLE. It is case insensitive and ignores anything after the first 8 characters and doesn't allow special characters. If my password is "aBc123De" I can log in by entering the password "ABC123DEFOOBARBAZ".
- jrockway 12y agoBetter than idiotic websites that enforce their character length limit on the client, but not on all pages on the client. So you can change your password to 123456789, but the login page will truncate it to 12345678
- dougedey 12y agoI just tested this, it is case sensitive and it doesn't ignore things after 8 characters. I'm using TD Canada, not sure if they've maybe updated since you tried?
- randlet 12y ago
- K0nserv 12y agoOSx does the same thing when entering passwords for private keys through the keychain
- reboog711 12y agoTo me this sounds like a crazy PCI Compliance related rule; and someone who doesn't understand anything about the PCI Compliance process or brute force hacking made the tweet. When I ran a web-site with an e-commerce store that accepted credit cards; I was required to have PCI Compliance scans done. One of the things they had me do was turn off the autocomplete on the password field with autocomplete="off". I have no idea how that makes things more secure. A lot of the things they made me do in order to be PCI compliant made no sense to me. I think I spent a week trying to convince them that my "error" page which showed up when someone mistyped a URL was not a security risk and was not something I should remove.
- ipedrazas 12y agoDo not complain... they know better, you see, they are "the experts"
- droope 12y agoautocomplete=off does not prevent you from using keepass, it prevents your browser from storing your password in your HD in plaintext. It's arguable that it's not the website's decision where the user caches it's passwords, but in high security environments I don't think it is an overkill.
- TheRealWatson 12y agoI doubt the autocomplete browser feature applies to password entry. It would freak people out if their browser started suggesting the password as you typed. It does apply for the username/email field, though.
- aaronem 12y agoFor a password field, "autocomplete" doesn't mean to suggest candidate completions, but rather to prefill with the password part of a previously saved username-password pair, and to offer to save such a pair (or update an existing one with a newly entered and different password) when the form is submitted. Giving the field an "autocomplete" attribute with the value "off" disables this behavior, which matters for PCI compliance because it forestalls browsers from storing the password when they might do so insecurely.
- mixedbit 12y agoReminds me of a password security policy that listed few SQL statements that can't be used in passwords.
- tempodox 12y agoThat was probably to prevent SQL injection, right?
- Zikes 12y agoProperly implemented parameterized SQL would allow '; drop table users; -- As a password without batting an eye.
- sp332 12y agoBut since you can't guarantee that every programmer and contractor, including future ones, write proper SQL, it's nice to reduce the attack surface a bit.
- KMag 12y agoReduce the attack surface by running the password through a proper modern Key Derivation Function (KDF) such as Scrypt before passing it to the database, not by running it through a few regexes.
- CocaKoala 12y agohey man don't post my password here. Now I gotta change it again and I'm running out of good sql queries.
- BoppreH 12y agoUnless I'm missing something here, lacking parametrization is not the issue here. The issue is that it's obvious they are saving the password in plaintext instead of hashing it, otherwise the password would never get close to an SQL query to allow injection.
- 12y ago
- jglazko 12y agoThanks for sharing. Made a great start to my day. I just the callers don't starting asking why we allow it!
- venomsnake 12y agoIf only there were malevolent hackers that could create I don't know automated post (please let it be post!!!) requests . That would be brute forcing nightmare. It is good that there is no such thing possible.
- troels 12y ago'Brute Force'? I do not think it means what he thinks it means.
- DanBC 12y agoSo, this is just someone on the BritishGas twitter account. We do not know if that person is repeating accurately what they've been told or just making stuff up. Assuming they asked the correct people in BG website accounts security, and those people said "it's to prevent brute force attacks" we do not know if that's the real reason they do it or if it's just what they say to people who ask. What is really frustrating is that there is no possibility of getting this changed - allow people to paste their passwords and use rate limiting to catch brute forcing. Having said that, some aspects of BG's computer system are horrific for customers so I don't doubt that they do stupid things for stupid reasons.
- mattstocum 12y agoThank you! I get amazed every time the internet freaks out because XYZ Company confirms "blah", when in reality, it's just a single service rep, who probably just wants to get you off of the phone.
- crazypyro 12y agoIts way worse with the advent of social media consultants/reps because their stupid explanation gets saved for the entire world to see, even if its about a section of a multi-billion dollar company they have no idea about. Low level reps have never had such an impact on companies as they do on social media.
- abritishguy 12y agoThe reason is irrelevant - there is no reason why you should do this.
- tokenizerrr 12y agoAs if blocking pasting actually stops brute force attachs... Can still just write a script that repeatedly makes those HTTP(S) requests. They accomplished nothing except annoy their more technically advanced users. Do they think a brute force attack is done by someone copy-pasting in passwords?
- alexhektor 12y agoPapyal does this in some scenarios as well. For one of my accounts, I can't paste the password from a password manager. Does no one here know why? http://ask.metafilter.com/221964/Why-does-PayPal-want-me-to-have-a-crappy-password http://ask.metafilter.com/221964/Why-does-PayPal-want-me-to-...
- ahdkaw 12y agoMy bank has a password-subset request form for logging in. This of course means that passwords are not being hashed. Also, I can be positive that the keystrokes used for the subset, are recorded and are visible to staff ("you have the correct letters, just try turning off CapsLock" was one response I got).
- tempodox 12y agoI would guess that the single greatest hole in computer / network security comes from the terror regime of incompetently enforced “security”. Users WILL get their revenge by undermining such measures any way they can in order to re-establish some usability. Like the best camera is always the one you have with you, the best security is the one your users will actually support, and not feel forced to circumvent.
- TeMPOraL 12y agoCall me a conspiracy nut but after reading all the accounts of banks and companies ridiculously reducing keyspace in weird ways (give me a good legacy-tech reason for [0]...) I'm starting to believe that they're doing it on purpose. [0] - https://news.ycombinator.com/item?id=7704235 https://news.ycombinator.com/item?id=7704235
- deleted 12y ago[deleted]
- manicdee 12y agoDisabling pasting requires disabling JavaScript in a real end-user browser with an end-user who doesn't know how to un-disable pasting. Never trust the client['s computer]. Disabling pasting is trusting the client's computer. Security in depth ends where the Internet starts.
- deleted 12y ago[deleted]
- dalore 12y agoOne could argue that a cross site scripting attack could use someone else's browser to paste to the site. So disabling paste disables one (small) vector for an attacker to use someone else's computer to attack.
- rwhitman 12y agoThis - I just realized the thing I was working on was supposed to be used in a public setting.
- rwhitman 12y agoDeleted my comment but I just realized why we did this - The product I was working on was to be used on a shared public browser / kiosk. The reason was to prevent one user from pasting in the previous user's password.
- timdierks 12y agoThe tweeter (probably a non-technical support person, so go gently on him or her as an individual) has revised the statement: "@passy I'm mistaken about the website security certificate but avoiding pasting of passwords is good practice & protects our customers 1/2" https://twitter.com/BritishGasHelp/status/463679554306203648 https://twitter.com/BritishGasHelp/status/463679554306203648 "@passy especially when using public computers. Alpha numerical policy ensures your protection without making special characters necessary^S" https://twitter.com/BritishGasHelp/status/463681274092462080 https://twitter.com/BritishGasHelp/status/463681274092462080
- rwhitman 12y agoI did work for a very security-minded HR outsourcing company on an html site to be used on a public kiosk and we also disabled paste via javascript for the same reason - to prevent a user from being able to paste in a previous user's password at the same terminal.
- zaroth 12y agoMakes no sense at all... Where ELSE might I be able to paste the contents of my clipboard? Now, clearing the clipboard AFTER pasting, that might actually make sense!
- grkvlt 12y agoGood advice. On a public computer you really don't want people accidentally leaving their password in the cut buffer for the next user to find.
- KMag 12y agoThen they should clear the clipboard via JavaScript when submitting the login form, not prevent pasting of the password. Password managers are simply too much of a win to block. Clearing the clipboard would be annoying for people who commonly copy a bunch of text out of a document, log in to their bank, and then paste the text somewhere else, but I suspect this is a rare workflow for most people.