Hacker News Reader

Comment by swayvil | Hacker News Reader

Ya, fucking with paste is a pet peeve of mine.

What's a good argument for fucking with paste?

The only one I've ever heard is "security." Sometimes people try to "yeah it's because for security we don't want some tool to paste credentials or clickjacking mumble something malware hacking clipboard spyware javascript browser" but most of the time the truth is "our sec people need to show controls for hardening the authentication process so they came up with that and we just did it because it wasn't worth the fight"

I've also heard "being able to copy/paste defeats the purpose of having a 'confirm email' field." I reject that but it's at least somewhat logical.

Too much gets justified with vague, handwavey "because security" excuses. We can't do this because... uh... because security, yea, that's it! It should be "Specific vulnerability or GTFO."

Yeah. NordVPN is an example of this handwaviness. They refuse to delete my account to which I can successfully log into and which I've never used because they claim that as "a security-oriented company we do not take account change or deletion requests lightly, hence we request payment information to confirm ownership of the account, as we would not want anyone but the rightful owner making such changes." Problem being, I've never paid NordVPN, and when I told them as much and asked what security problem could result from them deleting an unused account, they didn't respond.

I consider it a reduction in security because it makes entering proper random passwords more difficult - either I have to paste it somewhere else first (and leave it in plaintext on my screen) OR I have to use a more memorable/shorter password. When I can paste passwords, they can be as long as possible and never are actually visible in any way.

Completely agree. There was a particular US government-run website that I had to use that disabled pasting, and required obscenely long passwords (like 15 character minimum, at least two letters/numbers/symbols/capitals/etc), and forced rotation every 60 days, and aggressively blocked "keyboard patterns" and once a password had been used, it couldn't be used again forever. Given I only had to log in about once every 90 days, I literally had to change my password every time. I've never been more enraged at a product in my life. My passwords for that site may have looked good out of context, but in reality I just figured out "keyboard patterns" that it wouldn't detect and used those, and kept the password in plaintext where I could read and type it. It was the biggest security anti-pattern that I could possibly think of.

They finally fixed it after years of griping (I assume because the skyrocketing interest rates meant a large number of people suddenly began using it), but for a long time the official website for buying US government bonds wouldn't let you use your keyboard at all to enter your password, you had to click on an on-screen keyboard Java applet. For "security". Fortunately most password manager tools could break through it and paste into the password field anyway, but what a fuckup that was.

(And the site still sucks- you can't use the back button at all, for example-- but it sucks infinitesimally less now)

That’s exactly what I’ve heard. In a discussion about this recently at my job they wanted to add this to some login related forms.

I pointed out this was obnoxious and I’ve heard in the past copy & paste can be important for accessibility though I can’t be sure first hand.

Security BS was the reason I was given.

The irony is our IT department tells us to use a specific password manager and copy & paste usernames and complex passwords because the app doesn’t have browser integration. I assume “for security”.

A classic “save the children” argument of security. I know you aren’t making it but i have heard people argue this too many times over the years.

When you have a confirmation field, like signups that require you to type your email and then verify your email, blocking paste stops the user from typing a typo and then copy-pasting the typo into the confirmation field.

Another use case is when you want the user to type in the name of the project or resource before they delete it, sites sometimes block copy and pasting the name to avoid having users get into that habit and make a mistake.

Personally I dislike the UX, I think it's too user hostile to 99% of users at the benefit of 1% that are making a mistake that's obviously their own fault, but it does cut down on support time I assume.

> When you have a confirmation field, like signups that require you to type your email and then verify your email, blocking paste stops the user from typing a typo and then copy-pasting the typo into the confirmation field.

This argument is indefensible. Browsers have had autocomplete for over a decade, Contact book applications that store email addresses have existed over a decade, password managers that also handle email addresses over a decade.

To be clear, I'm not saying I agree with it. But this isn't a feature for users that have password managers. It's a feature for the staff that handle dozens of calls per week from users complaining they never got the signup email when they had given the wrong email. There's better solutions to that problem though, and like I said I'd be the first to advocate for one. But I can see how it's an easy tool to reach for.

That just takes the argument from bad to worse. “How will I condescend to my users without breaking their browser functionality?”

Zero times have I been saved by this feature

On the github "delete repository" screen or other extremely destructive actions, it stops you from muscle-memorying the confirmation and then accidentally deleting the wrong thing. Since you are actually forced, like really forced, to type out what you expect to happen, you won't delete my-important-work-repo when you meant to delete my-temp-test-repo.

You're forced to copy the name manually, which is just mindless typing, so doesn't force thinking, for that you'd need to provide some meaningful info about the repo to make it click that it's not a temp, or better yet make this actions undoable for some time

Mostly it seems to be a countermeasure against mistyping your email/password and then copy/pasting that bad value into the “confirm email/password” box.

Nowadays it’s a (hopefully accidental) countermeasure against password managers!

Reply on news.ycombinator.com