Don't Stop Me from Pasting Passwords | Hacker News Reader

Don't Stop Me from Pasting Passwords

ciamweekly.substack.com

31 pointsmooreds7 comments

People who prevent pasting of passwords have no understanding of security. They should be fired immediately.

Why? You just stopped me from using my password manager. And the fact that you don’t realize means you don’t use one. If you work in security and don’t use a password manager (and prevent others from same) you are woefully incompetent and should go find another career.

I am not saying this is a solution, but the reason you see this is because a number of companies, such as TikTok and LinkedIn, have been caught scraping the clipboard.

https://www.forbes.com/sites/daveywinder/2020/07/11/iphone-u...

https://www.forbes.com/sites/zakdoffman/2020/06/26/warning-a...

That said, for web applications, you are required to do things like use HTTPS for the modern clipboard API, which provides the user some guarantees. Not much works without HTTPS anymore though.

The hidden problem many password managers gloss over is how unbelievably insecure the Windows copy-n-paste is in Windows for decades.

IIRC (corrections welcome) Windows's window manager broadcasts the contents of the "copy" operation to any application that requests to receive the ? WM_CLIPBOARDUPDATE event... so any windows malware or even legit application with legal fineprint basically gets a plaintext message with the contents even before the "paste" occurs. All running apps are trusted.

Here's an example blog entry from "grumpy-sec"(?) laying this out (2018): https://share.google/0til1YzbF4xFRY7ls

Not to mention newer Microsoft conveniences like logging your clipboard history to your disk so it doesn't go away when your computer reboots, and/or syncing it to the cloud.

Or bank account numbers for ACH. Never understood this one, but I see it all the time. Even worse when I have to type it in twice manually.

Unintended? Consequences. It encourages weaker passwords, since you are not going to type in 14 of more characters by hand. I tried.

On campus, one service timed you out pretty quickly if you dawdled typing your password. I suggested that you should fail if you type it too fast, instead, to foil shotgun password typing bots, and give users more time for longer passwords.

That was before password managers.

It's hard to get everything right. After some rounds of white-hat password cracking, (the ones I got were so lame)I decided to modify the passwd command to crack passwords on the way in. Much faster with the plain text.

I have distrusted facial recignition since the Columbo episode (spoiler) in which Dabney Coleman sends someone elseout in his car with a face disguise to be deliberately snapped by a traffic camera for an alibi.

The photographically-aware detective notices that the light is wrong.

Thanks for "Helping us understand" via Columbo's timeless wisdom. ;-)

I'm in charge of IT for a 120 person org, anything that's a barrier to copying and pasting passwords just encourages simple password re-use, and the dreaded "laptop festooned with password Post-Its".

No fooling, I had to work on a Sun workstation in a lab. The lab instructor had installed his own password on it, so I had to guess it. (well, there are other ways, of course, but I didn't need one.)

There was a small framed print on the wall of some character from opera or mythology.

BINGO, I had the password within a minute.

Reply on news.ycombinator.com