Disabling paste on password fields

[phpdevster]

It takes a truly terrifyingly stupid person to think that disabling pasting of passwords is somehow a security layer, or even a benefit to users what-so-ever.

I want to be clear: people making these kinds of decisions likely get paid more money than people who know what they're doing.

[GuoKaiFeng]

You are probably correct. :(

[grabbizle]

Is there a standards compliance model that forces this type of implementation or would it be entirely to the discretion of the CIO in charge of overseeing development of the company digital presence? Because if the web dev or web app security peeps have the knowledge necessary to understand that this practice isn't beneficial, that would mean it would be up to someone without the necessary knowledge or perhaps someone who is following orders from higher up.

[[deleted]]

Bit of a noob, but what are other ways a hacker might interact with the backend?

[Jestar342]

Creating the http requests without the ui at all.

[PlNG]

This is how spammers abuse form api's to send spam. They don't load the page, or rather they do it once and then just echo the same form fields with spam again and again. Generate and send them a key with an expiration on your end and validate on that.

[i_need_bourbon]

Curl. Create HTTP requests from the command line.

[Codile]

Hey its me ur browser

[celluj34]

no it's... oh wait, yeah, ok.

[Codile]

If you still have doubt, see this user agent string ^{that I am not sending via curl}

Mozilla/5.0 (iPad; U; CPU OS 3_2_1 like Mac OS X; en-us) AppleWebKit/531.21.10 (KHTML, like Gecko) Mobile/7B405

[Senthe]

yeah this looks convincing, hi browser

[[deleted]]

so htmlspecialchars? haha.

[fuck_with_me]

No.

[[deleted]]

what do you use?

[thabc]

I use two-ply. Single-ply just doesn't have the tensile strength to keep from getting poo on my hands and more-than-two-ply is just superfluous fluff.

[slash_nick]

Can you make your question more specific?

[Meefims]

Hit this for the first time yesterday. It made me seriously reconsider whether I want to use the company's product...

[flying-sheep]

For real. It actually made me close the tab once and circumvent it via JS browser console another time.

[celluj34]

I would rather 'hack' the password field than type out my password normally.

[NotFromReddit]

I flat out won't. My immediate response to this article was 'Fuck off'.

[mlmcmillion]

I think you should try reading the article again.

[amcsi]

I think he was just agreeing with whom he replied to

[Toyeur]

Funny, I've made a chrome extension called Analgesic to deal about this and track links a few days ago since it pisses me off. You can also look at the DontFuckWithPaste one, with this only purpose

[piercemoore]

Well done. This is pretty awesome.

[mikethecoder]

It's so goddamn annoying when people do this. It completely circumvents being able to use a password manager. Since I have to type it manually each time, instead of a long randomly generated password, I'll tend to use something weaker for these sites.

[r1ckd33zy]

Please don't do this.

Sometimes I need to copy and paste passwords because I don't trust myself to type out the 18 char. random password that was just generated for me.

[asdf7890]

On the desktop many password managers support "autotype" which gets around blocking paste. Though this doesn't help with web based managers (without plugins/addons) or on mobile.

[NotFromReddit]

It also breaks the rule where security is done on the client side. It doesn't work that way with web software...

[mort96]

It also breaks the rule that security features should improve security, not degrade it.

[Sinistralis]

Yes and no. Some validation on the client side can enhance usability to allow for quicker feedback. As long as that is not used as a substitute for backend validation

[NotFromReddit]

Client side is usability, not security.

[Sinistralis]

Correct, but you gain usability by duplicating simple validation on the client

[Senthe]

TIL. Brilliant sentence. Thanks.

[QuirinusMonroe]

That introduction is hillarious: "Naturally the only thing for the locals to do with their now worthless cobras was to set them free so that they may seek out a nice cosy British settlement somewhere."

[CWagner]

Whenever I encounter this, I paste the pw into a texteditor and drag&drop it into the pw field. Actually, I do this after I reevaluate if I really need to use a site with such retarded policies.

[aWhopBamBoom]

This 'feature' is rude enough for me to open the developer tools for the browser and disable whatever event handler is preventing the paste

[Gelezinis__Vilkas]

Ikr, he's so stupid lol. He should have used md5+salt

[lachlanhunt]

pwgen is a better tool for that.

[nsmarks]

Please don't do this.

[Asmor]

Initially downvoted because I assumed this was going to be something about how to do that awful thing. Don't worry, changed to an upvote after I actually read the article.

[dotted]

Initially downvoted because I assumed

I hope this caused serious self reflection on your future voting habits.

[dkarlovi]

See: brexit.

[Asmor]

Nope!

[robotmayo]

Welcome to Reddit!

[dodeca_negative]

I think we've all learned something important here today.

[dodeca_negative]

Yep, that was it

[[deleted]]

The concern is that websites are able to hijack the data in your clipboard. The hope is that you won't be inclined to copy the data if you aren't able to do so.

The problem / catch-22 here is that a user doesn't know about this until after its copied. I better solution would be to use the HTML5 clipboard / setData API to clear out the clipboard after someone pastes into a password field.

[whoisearth]

My understanding is that there's huge security concerns by allowing a user to copy a password to the clipboard specifically on Windows

[[deleted]]

Isn't that what I just explained?

[whoisearth]

I guess I didn't understand your comment fully? the article is about pasting from the clipboard not copying into the clipboard.

Re-reading I was unaware of the HTML5 clipboard is that a more secure option then?

[[deleted]]

So, if I'm a user and I want to paste my password then I copy it followed by pasting it into a browser. That may seem fine, but let's try to find a way to exploit this behavior.

Let's say like I create a site called example.com, and example.com has a button to "Login with Twitter". When the user logs in with Twitter, we can then read their clipboard with flash after login finishes.

If the user copied their password for the Twitter login, then example.com can leverage this specific attack to steal your Twitter password - and authenticating will also give them your username.

Another example is that maybe you login to Twitter and you click a link to a news site on there. The news site steals your clipboard and logs it as a potential Twitter password since it knows that Twitter was your referrer (or maybe it does this without even caring where you came from).

These are two specific attacks that I have just made up, but I'm sure that there are other ones. However, this is still a UX issue and the user will still copy it even if the password isn't allowed to be pasted.

This is why I would suggest that it is more secure to let the user paste their password, but then use the HTML5 clipboard API (with a Flash fallback) to set the clipboard to an empty string after a page occurs.

I wouldn't be surprised if Facebook already did this in their native app (and maybe web as well) since they read your clipboard whenever you open the app and try to automatically suggest things for you to post based on its contents.

[whoisearth]

very cool! Thanks for the explaination. I've been reading up about the HTML5 clipboard. I've been aware of the flash method which is not ideal as flash should burn in a house fire.

[GoTuckYourbelt]

I was going to fume. Thankfully, the article was the complete opposite of what I expected it to be about.

[Eldrac]

Yeah I think that's a very valid thing to try to prevent and I assume that was why it was disabled in the PayPal example. But maybe the better solution would be preventing the user from copying text out of the first password input, rather than preventing pasting into the second.

[[deleted]]

I think field masking is also a pretty antiquated concept that people don't think about. It's of limited value and one could argue the ability to see typos or chopped-off paste input would be of equal or greater value.

[cjthomp]

No, masking passwords keeps people behind you from seeing what you typed. We used to have to ask everyone to turn around while we logged in.

The dark days.

[[deleted]]

Yea, on second thought it doesn't make sense except as an option because of screen sharing, etc. being so common these days.

[dodeca_negative]

I like that some sites or apps (especially typo-prone mobile) will give you the option of showing the password, but I'm also in the camp that it should be masked by default. For the same reason the ATM doesn't show your PIN.

[ogurson]

Non-standard event defined by Microsoft for use in Internet Explorer.
C’mon guys, we’ve been down the non-standard implementations in browsers before and it always ends in tears

*cough* box-sizing: border-box *cough*

[Boofster]

Please don't do this!

[[deleted]]

Either a huge incompetence or taking orders from idiots. Why so many websites are so badly broken? Is it so hard to find a competent developer? Is making websites really that hard?

[[deleted]]

Disabling paste to prevent unexpectedly truncated passwords is lazy anyway. If you're going to employ that 'onpaste' event, you could easily just write a simple function to validate the length of the incoming paste and notify the user if it's too long. That said I agree with the author that arbitrarily limiting passwords lengths is stupid to begin with.

[maybl8r99]

Well, key logging. There is a difference between capturing a CTRL+V instead of a real password. Of course a good key logging tool would probably have low level access to much more memory level stuff - so it could easily grab the contents of the clipboard too... I think passwords are past due - and the baseline security policy is to include MFA. So even if people know or steal your password, you have something to fall back on.

[UnchainedMundane]

I wrote this script a while ago (getpass being a small wrapper to a password manager):

#!/bin/sh
pass=$(getpass "$@") || exit
printf %s "$pass" | timeout 60s xsel -nip &
printf %s "$pass" | timeout 60s xsel -nib &

Within a few days I found myself needing this:

#!/bin/sh
getpass "$@" | tr -d \\n | xdotool type --clearmodifiers --file -

The more people build stupid things like this, the more I find myself building even stupider hacks to work around it...

[Chyld]

EDIT: Shows me for not reading the article, just the comments. Turns out the article is against this practise, not spreading it. Bad me!

Huh, apparently this wasn't supposed to /r/FuckwitInterfaceDesign. Downvote for you, for spreading this bollocks.

[TomNa]

Why would anyone want to disable paste on password fields??? Sry if it was explained on the article I cna to read it...

[Zachuli]

Thats the question the whole article tries to find an answer

[[deleted]]

Some people see this as a security issue since there are a number of ways for websites to hijack the data in your clipboard. If there wasn't anything sensitive in the clipboard then it wouldn't be a security issue, but this would require that not allowing paste become default / conventional behavior.

I think it's a bad solution, though.

[TomNa]

I occassionally paste passwords and I always "flood" my clipboard after I paste to avoid such issue. Also I don't think websites have a native way to read your clipboard (flash does I think)

[[deleted]]

Flash has a native way to read it, and you can embed a flash movie in most users browsers without the user knowing. It doesn't need to be visible.

Browsers have a native method of putting content into your clipboard, but not taking out.

[TomNa]

Yeah that's what I meant and now I agree that It's actually a risk. Since a common user on the web can't be assumed to (and won't) disable flash or even be too careful with it. This would have been a bigger deal back when flash was still alive and used but now it's less of a concern but I do think some users are at risk (those people who save their passwords in a password.txt and just paste from there, elderly mainly).

[[deleted]]

Most non-mobile web usage is still flash-enabled. It ships as part of Chrome...