Hacker News Reader

Comment by joosters | Hacker News Reader

There's an extra reason why pasting might be disabled on password creation fields: to prevent typos. If I mistype my password in the first box and then copy-paste it into the second, the text will match and my account gets given the mistyped password. You'll then never be able to log in.

If you force the user to type the password in twice, typos will be spotted immediately and can be fixed.

None of this affects password lockers like LastPass since they can autofill these forms in despite the HTML.

View on HN

The thing is, you can't copy FROM a password field. So you need to type it somewhere else first, and it will probably be readable there.

Wooosh! Time to re-read your "HTML for Dummies book"

What actually happens is you don't get locked out. You merely have to reset your password via email.

(Of course there is serious business that won't let you reset a password via email, but you can reset it... the process is simply more involved.)

Why would you ever type in a password when setting up an account? If you've generated a password, you can cut and paste that. Anything "random" you type is likely to be biased.

Why would you ever type in a password when setting up an account?

The overwhelming majority of users do, I'll bet.

The possibility that this completely ignores is pasting the password twice. The best passwords are randomly generated, lots of what looks like line noise, and very long. Computers are very good at making these passwords, so much so that programs exist solely for the purpose. Some password managers even have them built in. So, you want to create a new account (or change a password), what do you do? Randomly generate, then cut and paste twice (three times, if your password manager is not the same as your password generator). Disabling cut and paste kills this process, leading to the possibility of typos or weak passwords, thereby decreasing security. And, NB, not all password managers can autofill despite the HTML, and quite frankly, they shouldn't have to work around this misfeature masquerading as security.

I just came here to say the same thing. I remember, way back when, that this felt like the most natural thing in the world: type my password once, and then copy and paste what I just wrote to save myself the effort of typing it again. I eventually figured out why that was a bad idea (possibly after hitting a site or two that blocked copy/paste just like this).

I think it can create problems for some password managers, too: there are at least a few options out there that aren't based on browser extensions at all, so copy/paste is the expected interface.

Reply on news.ycombinator.com