Hacker News Reader

Comment by OJFord | Hacker News Reader

And let me paste. Especially if you're going to insist on doing it by SMS (also though please don't) then surely you should know that both Android and iOS make it easy and prominent to copy the code to clipboard...

View on HN

Or my favorite variant: Allow paste, but require at least one character type event before allowing submission (because otherwise the password/OTP field must be empty, right?)

Both of these are stupid but we should blame the OS/browser, there is no reason the site should be able to tell the difference or block pasting in the first place.

For the vast majority of the time I don't think the site's goal is even to "tell the difference" rather they implemented the form with the wrong event trigger instead of one that makes sense for monitoring inputs. You definitely want these other events in other scenarios so blaming the browser for having them isn't going to help anything.

Blocking pasting is intentional 100% of the time.

You'd be surprised, even for the paste half of the equation, how many go out of their way to make a completely custom input to do it better™ that fails to support obvious things by happenstance. See the topic's article about looking for number keycodes instead of processing text input as an example.

> they implemented the form with the wrong event trigger

Well yeah, but their first mistake was implementing a form text field by listening for event triggers.

There are actually some good reasons. The default paste action will just paste text or HTML. However most OS clipboards have the ability to paste various types of content. If the clipboard contains a "better" media type it makes sense for the application to handle it and prevent the default action.

For example:

1. Pasting an image into a markdown field. A common action is to upload the image and insert the correct markup to embed it.

2. Pasting richer content inside an application. For example when copying a rich widget you may embed a text representation, HTML representation but if the user pastes the widget back into your app it is often best to keep a "native" representation that can be used to faithfully reconstruct the original data.

Related, my current rage-inducing gripe is that at $DAYJOB, where I have to use a Windows VDI, pasting text from OneNote into a Jira comment results in a screenshot.

I don't know whether OneNote is more to blame (I already hate it because Ctrl-C rarely works to copy) or Jira, or Windows, or who, but it's just maddening.

(Clarification: pasting text results in a picture as an attachment. Didn't mean to imply that pasting would actually take a snapshot of the screen.)

fortunately, firefox now has a 'paste as plain text' option. So I can just use it instead.

Can't test, but what happens if you paste with Shift-Ctrl-V?

Well, of course I now can't reproduce the problem for whatever reason, but I'll keep that trick in my pocket, thanks.

Presumably browsers could replace a paste with n “key down” and “key up” events, but I bet that causes other issues elsewhere and doesn’t seem like the right solution.

Ultimately, misguided developers or PMs will always find a way to make our lives harder if they set their mind to it; let’s not make it an arms race.

That said, for password managers and known-bad sites, your proposal sounds tempting!

> Presumably browsers could replace a paste with n “key down” and “key up” events

Or a single text input event. Key events will get you nowhere in the presence of CJK IMEs, for instance.

You know that, but do the developers of broken password input fields?

The question is whether I know it despite not being a front-end developer, or because of not being a front-end developer.

(Around 8–10 years ago I worked on keyboard input for ChromeOS, and way too much of it was trying to emulate 1995 Windows Netscape so that most sites would mostly work.)

I've seen this in React where an autofill doesn't do anything in terms of invoking the changed callbacks. As such, adding 1 character invokes the callback, and sets the value for React. You obviously remove it.

My bank does this. Infuriating.

I’m a fan of the extension ‘Don’t f** with paste’

I don't often see websites blocking paste on OTP code fields. What I do see often is websites breaking up the OTP field into n separate input fields, and having some code that auto-switches between the input fields as you type them. However, the auto-switching code doesn't handle pastes, so if you try to paste the entire code only the first digit gets entered. ‘Don’t f* with paste’ doesn't help with that.

These are also terrible if you need to go back because you mistyped. Shift+Tab brings your cursor back to correct it but their code pushes the cursor right back into the next empty box. (And they do this with a lot more than just OTP.)

I’ve to do this with OTP codes at work as well. Reimplementing paste here I’d say is pretty trivial (though you have to add Yet Another Event Listener) but I’d agree with the general sentiment here to just not overcomplicate it at all if possible

Ugh yeah, honestly if paste is disabled because that was the most effort they were going to put in to 'fixing' that I'll excuse it. Better to not even appear briefly like it might work!

I recently learned we can drag password from any text or Bitwarden to the password fields without triggering paste event.

some shit tier sites coded by obstinate assholes do not let you proceed to submit the form without seeing keyboard events

1Password just added Auto type in the Lab section of the app for desktop apps and… that. It types username/email, hits enter, password, enter.

For Safari on iOS and macOS (and some other browsers on the Mac), there's the excellent (and similarly well named) StopTheMadness extension.

https://underpassapp.com/StopTheMadness/

There are a few sites I've found over the years which won't allow this for password fields. They nag and nag that you need strong passwords... great, mine's 100 characters of gibberish in my password manager. Then when it comes time to paste it, they've got that disabled. You know, for security purposes.

I once had an account with a bank whose website did this, but only for the change password form. Which wouldn't have been too bad except they also had a "force users to change their password every X months" policy. I was so annoyed that I opened dev tools and used the console to circumvent their stupid javascript every time.

I think I'd switch banks over this

Banks are guilty of worse, but they're difficult to switch. And how do you know that the next one will be any better? Smaller banks in particular seem to be using some whitebox software title to do their online banking, so you might go to all the trouble only to discover the exact same. How many times can you switch up your direct deposit before HR/payroll gets annoyed with you?

Also copying from my iPhone and pasting into my Mac is so practical it feels like straight up science fiction

> Android and iOS make it easy and prominent to copy the code to clipboard

I've noticed some inconsistency on Android: many, but not all, SMS notifications from Google Messages (Pixel) contain a "Copy code" button when the message has an OTP. I wonder if there's some kind of heuristic or list of known phrases/senders baked into the app, always lagging behind as things evolve.

OTP messages from non-A-list services have only the "Reply" / "Mark as read" buttons on the notification a substantial portion of the time, at which point one can type the code manually or copy the whole message after opening it.

> I wonder if there's some kind of heuristic or list of known phrases/senders baked into the app,

It's actually rely on specific message format. And it's a function of google message app instead of system wide function. Although the pattern isn't documented anywhere.

https://blog.google/products/messages/five-new-features-try-...

One of my favourite features in Brave is “Force Paste”.

In Firefox AFAIK right-click always opens the menu with a Paste option.

Also, in Firefox SHIFT+right-click always opens the menu, even when the site has tried to hijack right-click.

But that’s the same as pressing the paste shortcut. I guess the force option emulates keypresses or something like that to always allow paste, which the right click option of Firefox doesn’t do.

FF has force paste now too

Tangential, but are there any really good integrations with authenticator apps/autofill like the way iPhone autofills SMS codes?

I know SMS is less secure but the UX of autofill on e.g. iPhone at least is so much nicer than having to pop out of my browser/app, open an authenticator app etc.

Reply on news.ycombinator.com