Hacker News Reader

I've seen banks do this, and I agree it's incredibly annoying. KeePassX's autotype function bypasses copy-and-paste restrictions, since it emulates the keyboard as it types your password.

Pressing F12 and modifying the DOM usually works as well.

Next is custom screen keyboards made with <canvas>

You're allow only to input using their custom screen keyboard AND randomize the position of each key.

Banks: this is to prevent attacker use keylogger or mouse position logger.

I was like, are you fucking serious ?

Shh... don't give them any ideas.

Actually, no. This is about "memorized secrets", not "secrets stored somewhere else". That's not to say that secrets stored somewhere else can't be better than passwords in certain situations, they're just a different type of authentication. A password is "something you know", and stored password is "something you have". Some systems are required to use different types of authentication, one thing you know, one thing you have, and one thing about you (e.g. fingerprint/retina scan). Allowing a copy and paste from a different source violates the "something you know" requirement.

Usually this is accomplished by blocking the keyboard shortcut; pasting via right-click menu typically works.