Asklemmy

42502 readers

1394 users here now

A loosely moderated place to ask open-ended questions

Search asklemmy 🔍

If your post meets the following criteria, it's welcome here!

Open-ended question
Not offensive: at this point, we do not have the bandwidth to moderate overtly political discussions. Assume best intent and be excellent to each other.
Not regarding using or support for Lemmy: context, see the list of support communities and tools for finding communities below
Not ad nauseam inducing: please make sure it is a question that would be new to most members
An actual topic of discussion

Looking for support?

Looking for a community?

Lemmyverse: community search
sub.rehab: maps old subreddits to fediverse options, marks official as such
[email protected]: a community for finding communities

~Icon~ ~by~ ~@Double_[email protected]~

founded 5 years ago

MODERATORS

[email protected]

Why do sites disable pasting in password fields? (lemmy.ml)

submitted 11 months ago* (last edited 11 months ago) by [email protected] to c/[email protected]

42 comments fedilink hide all child comments

It's 2023, why are websites actively preventing pasting into fields like passwords and credit card number boxes? I use a password manager for security, it's recommended by my employer to use one, and it even avoids human error like accidentally fat-fingering keys, and best of all with the credit card number I don't have to memorize anything or know a single digit/character!

I have to use the Don't Fuck With Paste addon just to be able to paste my secrets into certain monthly billing websites; why is my electric provider and one of my banks so asinine that pasting cannot be allowed? I can only imagine downsides and zero upsides to this toxic dark-pattern behavior.

There is even a mention about this in NIST SP 800-63B, a standard for identity management that some companies must follow in the USA, which mentions forcefully rotating passwords and denying "password paste-in" as antiquated/bad advice:

Verifiers SHOULD permit claimants to use “paste” functionality when entering a memorized secret. This facilitates the use of password managers, which are widely used and in many cases increase the likelihood that users will choose stronger memorized secrets

Edit: I discovered that for Firefox users there's a simpler way than exposing your secrets to someone's third-party addon. Simply open about:config, search for dom.event.clipboardevents.enabled, and change it from true to false.

Edit 2: As some have pointed out, that config value interferes with regular functionality on some sites. Probably best to leave it alone unless you know what you're doing.

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 2 points 11 months ago (1 children)

Edit: I discovered that for Firefox users there's a simpler way than exposing your secrets to someone's third-party addon. Simply open about:config, search for dom.event.clipboardevents.enabled, and change it from true to false

Note that this disables all DOM/JavaScript clipboard events, so sites that need custom clipboard handling (like Google Docs) won't work properly if you try to copy and paste.

What you can instead do is:

Right-click the password field
Click on the "console" tab in the browser dev tools
Type $0.value = 'password' and press enter, with the correct password of course.

[–] [email protected] 2 points 11 months ago (1 children)

But then you'll have to display your password in plaintext (could be a problem around other people) and leave a trace in the console.

[–] [email protected] 2 points 11 months ago

That's true. You could instead try to unattach the paste event handler, but that's more effort and isn't a one-liner. There's probably a browser extension for it.

I usually don't have other people behind me when using my computer, but most of my passwords are 30+ characters and randomly generated, so I'm not too worried about someone seeing it for the short period it takes me to paste it into the console the run clear() to clear the console.