Hacker News Reader

Comment by lysium | Hacker News Reader

While long and random passwords are a good thing, there are still applications that make that very difficult to use.

I'm looking at you, Apple AppStore, letting me choose a new password after only the second wrongly-entered, disallowing copy&paste on that website to enter the new password, requiring JavaScript on that website to enforce the no-copy&paste rule and then not showing me the characters I enter.

That's ridiculous. After the fifth attempt to enter my 20-character password correctly (which was chosen randomly by my Password manager), I gave up and entered a 8-character password.

So the problem is not only the user, but also ridiculous application requirements.

View on HN

That is indeed annoying. As a work around, if you use a browser or browser extension that lets you modify the DOM on the fly, you can disable the paste blocking. For instance, in Safari, use "Inspect Element" on the password field, find the onpaste="..." attribute, double click the onpaste and change it to something that isn't a valid event name.

You can then paste in the password field.

It should be reasonably possible to make a bookmarklet that goes through all form elements on a page and does this automatically to all that have onpaste handlers, so you don't have to bust open the inspector and dick around every time you want to log in.

That's good to know, I'll try it next time!

There is a good motivation to prevent copy-and-paste - they might be storing the password in plaintext somewhere.

No, there isn't. From Stack Overflow (http://stackoverflow.com/a/4760170/):

"No. Why stop the user from copy-pasting their own password?

Whenever you're looking at a security protection like this, it's important to ask yourself: Exactly what kind of attacks are am I trying to protect against? In this case, even if you prevent copy-paste, the user can just retype it if they really want to, after all. And if you're worried about Evil Spyware, that stuff can just install a browser extension and look at the password in the DOM directly, or install a keylogger and capture it as it's being typed.

Indeed, this can even reduce security. Consider if the user's using a password management program that can either put the password into the clipboard, or display it for retyping. If you prevent paste, that means the user must display the password on screen for any shoulder surfers to see."

Agreed. If you stop me from copy and pasting, there is always pen and paper. Security auditors have fun making companies look dumb when they find passwords to critical systems on post-it notes.

If you are using long passwords, you don't need to use purely random text, you can use a phrase.

Unfortunately, my password manager is bad at generating phrases and I'm bad at generating random phrases.

Reply on news.ycombinator.com