A loosely moderated place to ask open-ended questions
If your post meets the following criteria, it's welcome here!
Looking for support?
Looking for a community?
~Icon~ ~by~ ~@Double_[email protected]~
Agree. It is a stupid and antiquated idea. Two things I'd like to say though:
One: you can probably set up some form of auto-type from your password manager to get around this issue.
Two: blocking pasting is probably because password managers and operating systems must be secure when it comes to the clipboard, and clipboard management. Because if that's not safe, your passwords you are copying and pasting are not safe.
these days password managers clear the clipboard, still the clipboard is not secure which would be why some still block it.
really its an indication we need to drop User/Pass auth once and for all.
Which has always been an asinine point of view. By the time a site has blocked the paste the password is already in the clipboard. No security has been added in that regard, only frustration.
Edit: I discovered that for Firefox users there's a simpler way than exposing your secrets to someone's third-party addon. Simply open
about:config, search fordom.event.clipboardevents.enabled, and change it from true to false
Note that this disables all DOM/JavaScript clipboard events, so sites that need custom clipboard handling (like Google Docs) won't work properly if you try to copy and paste.
What you can instead do is:
$0.value = 'password' and press enter, with the correct password of course.But then you'll have to display your password in plaintext (could be a problem around other people) and leave a trace in the console.
That's true. You could instead try to unattach the paste event handler, but that's more effort and isn't a one-liner. There's probably a browser extension for it.
I usually don't have other people behind me when using my computer, but most of my passwords are 30+ characters and randomly generated, so I'm not too worried about someone seeing it for the short period it takes me to paste it into the console the run clear() to clear the console.
Same reason some websites still have max password lengths of 12 characters: Bad programmers that don't know what they're doing when it comes to the most basic of security concepts.
Bullshit requirements like that come from product managers.
Programmers would rather be lazy and not have to implement a limit anyway
This one always surprises me. Who the fuck is not hashing passwords? What else is wrong with this site if such basic concepts are ignored?
If you use a proper password hash function, and some joker submits a million-character password, you've got a denial-of-service attack.
The limit doesn't have to be 12 characters, but there does need to be a limit.
Why would that be a DOS? The hash of something is always the same length. Might only take a bit more time to compute, but a million characters isn't that much with modern hardware. If anything, the risk of collisions would be higher.
Hashing is typically done server-side. So you need to transmit the password to the server and you can't have a truly unlimited data limit. Pretty much every web server will reject requests over some size so while it's entirely reasonable to support something like a 1,000 char password if you really wanted to, having it be truly unlimited with something using a 10 million character password is a security/operational risk in itself.
Highly recommend this extension ::Absolute Enable Right Click & Copy:: available for both FireFox and Chrome
Wow, thank you for that, while we're at it, can we stop websites from fucking with the back history button ? Thanks !!
That ship has sailed... So many sites don't actually change pages, they just load different data - it's way faster and looks better
Problem is, the back button takes you off the site no matter where you are, so now you can change the URL and change the history through code to have the best of both worlds
Then, there's the people who do it badly, and there's the people who think "hey, if you need pro StarCraft level clicking speed to back out of my site, maybe for some reason that will make them decide to stay"
I just edit the HTML and paste the text in as the value. Sites that do that are jabronis
Hey man I want to thank you for sending me into a time vortex back to the 90s. I forgot about that word.
Clipboards (the buffer where copypasta is stored) are a weak link in security because ANY app can expect access to it. If there is malware on your system it generally has access to the clipboard buffer, and therefore any credentials you might paste.
"OK, but usually you only paste the password and type the username?"
Quite true. Keyloggers are also a thing and easy to install on desktop OS, maybe harder on mobile.OS.since (at least on android) you need to grant permissions for keyboard apps. Either way if a keylogger is installed then you're fucked.
It boils down to a bad risk assessment. Those services decided memorized credentials must be manually typed to prevent clipboard snooping at the (likely) cost of reduced password entropy and/or weak MFA (e.g., SMS or email based TOTP). In other words: stupid CISOs.
uh if you've got a keylogger on your system, clipboard access is not that far away
The problem is, by the time you’ve figured out that you can’t paste your password you’ve already copied it …
This is one of the dumbest shit ngl. My bank also does this. However they go one step further. They force a maximum 12 letter password and 1 character of each type (capital, small, number, symbol) is necessary. This actively reduces password security smh
Mine truncated the first 8 characters, when I discovered that I sent them a request to their cyber security department and they told me.of was by design.
I closed my account over that bs
Wtf lmao. How to I check if mine does it💀
Type the first 8 chars and see if you can still log in?
Good idea, although this wouldn’t tell you if they truncated the password at 9 characters instead (or 10 or 11 characters etc).
So you would have to try different attempts without making too many in one sitting that gets you locked out.
If you tried your password without the last character, then I think that would tell you if ANY truncation is being used (but it won’t tell you whether it happened at the 8th, 9th, 10th etc character). But that seems like the best thing to try first just to rule it out.
It's because they likely have an ancient backend that can't fit it in the database field...
a legitimate reason to close the account and back away slowly
Because people would write down their passwords? I wonder how many people use their browser's built in password manager
That's one way it is weaker, but moreso because it reduces the entropy. If a user can provide a password which uses 26 letters, upper and lowercase, 10 numbers, and an unrestricted set of symbols, but for the sake of argument we'll say 10, then there are a lot of possible combinations. If you are limited to only 12 possible at max, it is 46^12. Now you impose an artificial requirement that it is one of each, then it actually weakens that further by making the hacker know that there is one of each in there so it is 2626101046^8. Or roughly 910^19 vs. 1.3610^18. I personally try to use passwords which are between 16-20 characters long, or roughly 2*10^33. By restricting the total number of characters and forcing specific combinations, then the password is less cryptographically sound.
Using this calculator, https://bitwarden.com/password-strength/, it is a difference of 3 hours vs. centuries using the bank's mandate vs. only lowercase and 20 characters.
Edit: Something seemed off about the math. Should have multiplied instead of added, but still less sound secure because there are imposed requirements. The biggest issue is that there is an upper limit of 12 characters.
The 20 character requirement is kind of a huge component though.
Sure. Banks should be enforcing that instead of special characters. But the vast majority of people would just choose "football" or "password" as their passwords if they weren't required to do something more complex.
I disagree with the argument that it's less secure to require symbols in passwords as a blanket statement . It's less secure to require symbols in passwords than if you are also enforcing much longer minimum passwords as well.
Sure. Banks should be enforcing that instead of special characters. But the vast majority of people would just choose "football" or "password" as their passwords if they weren't required to do something more complex.
Ironically though, something like
IveLovedUsingFootballAsMyPassword!EverSinceThe1980s.
as a password would be miles ahead of even the most random character combination possible, but which is only 12-20 characters long.
And as an added bonus, the above example is practically guaranteed to have never been used before, in addition to being correct horse battery staple (that is, tremendously easy to remember).
I hate when a website/app in this day and age imposes an absurdly low upper password character limit like 30. (cough looking at you, PayPal, when I re-set my password a few years ago it was freaking 20, not exaggerating).
Shouldn't password length below like 100 (or realistically, any length until it starts crashing the js behind it?) not matter anyways, since it's all salted, peppered and hashed before further processing anyways?
There is no technical reason for there to be a maximum length on the user's password.
Watch:
Here's a password bitwarden generated for me:
Bonded-Reforest-Prenatal7-Spoken-Straggler-Catcall
Here's the base64-encoded SHA3-512 hash for that password:
Q2WaVLdTAg5T4xi3VB5PMI7GkAv3np9Usa2+uTMglbMcDDAdYXzUNgAzzYLoSWku/e007vkKfvSotzoriSKt4Q==
Here's the has for the password password:
6adUhnNqVQr0/qhh4jeDBcSlVaBQlN7h3KL2iv6knMOlDo3m6hMepSExH01vsFShRugoL441/y5jaMGmLpCXFg==
Notice how the thing the website should be storing in their database is exactly the same length, regardless of the input?
For extra fun, here's the hash for your sample password:
GbxnrQ31PInMSu2ik2ZR5TefgXIInSJBxZ5zwcYmkRxzw07tZoxPqJbEmcbuTBpzCZzwLrqqcxz04p8ToGszRQ==
Here's a tool to generate your own hashes: https://www.liavaag.org/English/SHA-Generator/
I mean, if we're being pedantic, there's a reasonable technical limit once the password reaches multiple MBs of data.
But yes, there's no good reason for the actual limits we're seeing out in the wild.
Yeah, I agree they should be requiring much longer minimum password lengths (and show users how to use passphrases). Max password lengths are also absurd.
As always, Firefox steps up against stupid website behavior.
Just adding that financial institutions are very hesitant to adopt new technology, and therefore tend to abide by what tech enthusiasts would consider antiquated best practices.
Source: Software engineer in Fintech
KeePass has an auto-type feature. It basically presses keystrokes right into the input field.
I never have to worry about sites disabling pasting into fields because:
Also, putting your password on your clipboard is Bad Practice because any application (including a javascript web page) can inspect your clipboard
I could be wrong because I haven’t used KeePass in a few years… but it’s my understanding that the auto-type feature doesn’t work on every website, depending on how they’re designed.
So auto-type will work on websites where the username input field and password input field are on the same page, and where you can switch from the username field to the password field with a single tab key press.
However I don’t think it will work on sites where the username needs to be submitted first before the password field is even visible. I think signing into a Google account is an example of this.
At least that was my experience when I was using KeePass a few years ago. Please correct me if I’m wrong.
The only app that won't let me use KeePass autotype is Planetside 2's launcher. I've never had any trouble in any other app with KeePass's auto-type feature -- including to log in to Google.
If a site is asking for a username first, then I can auto-type the username too ;)
Ah ok, thanks for letting me know. I haven’t used KeePass in a long time but I’m going to download it and give it another try now. It sounds like a good idea to avoid passwords from being stored in the clipboard. Thanks.
I have written important passwords into chat windows too many times to use the auto-type function. In my case it's much worse to use autotype because the UI isn't obvious into which window it will autotype and press enter to send the message to everyone. At least with the clipboard I have to press the enter myself when I see I pasted it into the correct field.
But to get around that I'm actually storing my password in the browser too and syncing them between my firefox instances with my self hosted sync server.
Yes I’ve made a similar mistake in the past. On one screen I performed the auto-type and it was in the process of typing out the user/password combination, and while this was happening I clicked into a chat window on my other screen without thinking. The chat window immediately started having part of my password typing into it!
Luckily I managed to click elsewhere in time to prevent ‘enter’ being typed at the end of auto-type.
It’s just a reminder that you have to wait for auto-type to complete before you can do anything else.
The UI isn't obvious into which window it will autotype
I found that if you click into the username field first and then switch directly to KeePass without opening/switching to any other applications in between, then when you click auto-type in KeePass, it works every time. This is because the browser window was the last used application before KeePass was selected. But yeah, it’s not an ideal user experience.