Hacker News Reader

Comment by mcv | Hacker News Reader

I'm frequently baffled when I encounter a login form that doesn't allow pasting a password. Of course with developer tools I can just remove the attribute that causes that, but plenty of internet users lack that level of technical knowledge and are forced to resort to easy to member and very likely reused passwords.

I feel like this is a similar red flag as the 'no single quotes in passwords' limitation that used to be common.

View on HN

With Firefox (at least the desktop version) one can set this about:config option (dom.event.clipboardevents.enabled) to "false" and websites can no longer block you from pasting things into form fields on your own browser on your own computer.

By far the best comment in this thread. Thank you.

Any idea if that syncs as a regular profix sync?

Thanks, I've been wondering if something like that is possible.

I prefer to use the autotype function of password managers (Ctrl-V on Keepass[0], and rofi-pass[1] for pass(1)); there are other issues with them though (such as "modern" login pages [2])

[0] https://keepass.info/help/base/autotype.html

[1] https://github.com/carnager/rofi-pass

[2] http://bradfrost.com/blog/post/dont-get-clever-with-login-fo...

In Firefox you can override this and re-enable pasting by toggling dom.event.clipboardevents.enabled to 'False' (in about:config).

https://developer.mozilla.org/en-US/docs/Mozilla/Preferences...

I use Bitwarden and often sites won't be set up for auto eneter of login credentials. In that case, Bitwarden provides an easy way to simply copy/paste the user/pass.

Sometimes using Shift+Insert instead of Ctrl+V can allow you to paste into these fields.

I can understand if a government service requires this but it also happens with a normal, ecommerce website!

I really don't understand why. Please explain.

If it's a US Federal Government service, you should point out to them that they are going against the explicit recommendation of NIST[1].

1. https://pages.nist.gov/800-63-3/sp800-63b.html#sec5, under 5.1.1.2 Memorized Secret Verifiers, 'Verifiers SHOULD permit claimants to use “paste” functionality when entering a memorized secret.'

Sadly the US Federal Government is a massive and unwieldy collection of organizations. I work in the Federal government and my part of it doesn't comply with NIST's modern guidelines at all. They probably will at some point, but department/agency level IT changes take years to be approved.

I do not understand why a government service would require this. Governments should improve security, not undermine it.

(Then again, most governments don't seem to care much about what I think they should be doing.)

The generated password is usually just random string and hard to memorise. If you need to use the password outside of the web, e.g. on telephone or in a physical office, then it makes sense to use a password you creates. This is similar to the "master password" used by password manager, you should remember it by heart instead of generating a random one.

Well in my little corner of the US govt the web certificates are usually expired and I can't log into my work email from home.

Are they actually expired? In both corners of the US government that I've worked most of the certificates are self-signed and work computers have the agency's root certs added to the browser.

Reply on news.ycombinator.com