Hacker News Reader

Comment by emsy | Hacker News Reader

Second worst password rule: preventing to paste in the password field.

As seen at The OS X FileVault dialog, PayPal, Blizzard and many more....

Third worst password rule: preventing the browser from prompting user to save the password for your site. I found this to usually happen with home banking sites (as a workaround, I usually have to disable and re-enable javascript).

Chrome hackaround:

1. Right-click the field, Inspect element.

2. Go to Console tab, type: $0.value = 'mypassword';

$0 is the last selected element: https://developer.chrome.com/devtools/docs/commandline-api

I have this as a bookmarket named 'Reveal Passwords':

    javascript:(function(){var IN,F;IN=document.getElementsByTagName('input');for(var i=0;i<IN.length;i  ){F=IN[i];if(F.type.toLowerCase()=='password'){try{F.type='text'}catch(r){var n,Fa;n=document.createElement('input');Fa=F.attributes;for(var ii=0;ii<Fa.length;ii  ){var k,knn,knv;k=Fa[ii];knn=k.nodeName;knv=k.nodeValue;if(knn.toLowerCase()!='type'){if(knn!='height'&&knn!='width'&!!knv)n[knn]=knv}};F.parentNode.replaceChild(n,F)}}}})()

You can do this in FF and probably others by using this method:

1. click on the input field. 2. Type document.activeElement.value = 'MyPassword'; into the console.

That's good for browser passwords, but finding out that your 64 character password can't be pasted in the system dialog after erverything is set up is extremely frustrating (there is a hard to find command line workaround though). I think Blizzard enforces the no-paste rule in its Battle.net launcher (that you can't trick) but I'm not 100% sure.

Most of the time you can paste the password in another field (like the username) and select and drag it to the password field.

Browsers should probably not allow that kind of interaction between javascript and the password field.

99% is probably stolen passwords and 0.0001% brute forced passwords.

A password thief surely wouldn't be stopped by a text box that doesn't allow Ctrl-V.

No, 99% are the ones copied from a password manager application.

If there is a Trojan, it can read the clipboard data. But most ppl save their password unencrypted. And can then be found by exploits in browser, java, flash, etc. Or unknowingly sharing the password file on a file-sharing network :P

It's more secure to write it down on a piece of paper, then saving it on your hdd and copy/paste into the password box.

Why should a trojan bother to read files or clipboard data when it can read the password directly from the input field? You don't even need a trojan for this purpose, simple XSS at the right spot is sufficient. This means it's irellevant wether you write it on paper or in a file, since the password will be stolen when it's entered. The only thing you can do is to make sure your password is long enough so it can't be guessed, and that's where a password manager will help you.

Reply on news.ycombinator.com