Hacker News Reader

I always assumed that the reason paste is disabled on change password forms is to prevent you from changing it to something you don't know. The whole point of making you type it twice is so that you get it right. If you type the password once and paste it twice, that is moot.

Not that I necessarily agree with that notion (just make it easy for me to change it again) but that's the idea. I thought.

View on HN

And that's exactly the point of OP. You can only "know" weak passwords. Disabling paste is assuming and forcing people to use weak passwords.

What about the people who already have weak passwords, and accidentally misspell their dog's name or whatever? They're probably in the overwhelming majority compared to people using strong, complex passwords. Disabling paste here seems to be more of a convenience decision rather than a security one.

Isn't that what the "I forgot my password" feature is for?

Reply on news.ycombinator.com