3 ms·

This all seems rather bonkers. But 1Password isn't exactly the impartial "they've spent more time thinking about this so they must get it right" party. Their

This all seems rather bonkers. But 1Password isn't exactly the impartial "they've spent more time thinking about this so they must get it right" party. Their entire product and way of thinking depends on being able to auto-enter passwords. Anything that interferes with that, regardless of whether it works or not, is going to get a thumbs-down from them. As for pasting into the second password field on change-password, maybe they don't want people copying out of the original field and pasting into the second? I'd get that, and the organization-wide costs of password recovery are probably very significant for a company like PayPal. . . . But don't all browsers already disable copying out of password fields? This is the silliest kind of arms race. Users try to keep ahead of security nonsense, and self-styled security gurus keep on trying to stop them.

SideburnsOfDoom 12y ago
> But 1Password isn't exactly impartial ... their entire product and way of thinking depends on being able to auto-enter passwords. You're not just talking about a product, 1Password, you're talking about the whole class of password managers - 1Password, KeePass, lastpass etc. http://lifehacker.com/5944969/which-password-manager-is-the-most-secure http://lifehacker.com/5944969/which-password-manager-is-the-... There are many and they all do this. Many of them also offer "auto-type" i.e. simulated keystrokes, as an alternative to paste. It works even when paste is disabled. On the whole, using a password manager is a very good thing: http://anthonysteele.co.uk/nobody-knows-anything-about-passwords http://anthonysteele.co.uk/nobody-knows-anything-about-passw... http://www.troyhunt.com/2011/03/only-secure-password-is-one-you-cant.html http://www.troyhunt.com/2011/03/only-secure-password-is-one-...
cwp 12y ago
He wasn't asking 1Password if it's a good idea, he was asking them why developers disable pasting. It's precisely because their livelihoods depend on being able to auto-enter passwords, that they're likely to know the answer.

SideburnsOfDoom 12y ago

> But 1Password isn't exactly impartial ... their entire product and way of thinking depends on being able to auto-enter passwords. You're not just talking about a product, 1Password, you're talking about the whole class of password managers - 1Password, KeePass, lastpass etc. http://lifehacker.com/5944969/which-password-manager-is-the-most-secure http://lifehacker.com/5944969/which-password-manager-is-the-... There are many and they all do this. Many of them also offer "auto-type" i.e. simulated keystrokes, as an alternative to paste. It works even when paste is disabled. On the whole, using a password manager is a very good thing: http://anthonysteele.co.uk/nobody-knows-anything-about-passwords http://anthonysteele.co.uk/nobody-knows-anything-about-passw... http://www.troyhunt.com/2011/03/only-secure-password-is-one-you-cant.html http://www.troyhunt.com/2011/03/only-secure-password-is-one-...

cwp 12y ago

He wasn't asking 1Password if it's a good idea, he was asking them why developers disable pasting. It's precisely because their livelihoods depend on being able to auto-enter passwords, that they're likely to know the answer.