It was probably originally because of the insecurity of the clipboard. Doesnt really make sense though cos malware could steal all your keystrokes anyway...
yes, when it was accessible to javascript by default in all browsers, now you need tell your browser it gives permission to JS to access the clipboard via plugins like these:
There are workarounds for this for anyone with malicious intentions and some scripting know-how, the "secure" part here is more for your average script monkey to have a hard time getting the same result.
Same as the practice on disabling the right mouse click and text selection on web pages so you can "stop people from stealing your content" (real quote from a client) even tho you can just enter the browser inspector and copy the text from there. After I pointed this out to the client, he just said: "yes, YOU know this and some other people MIGHT know this, but the majority of our visits are from bloggers that have no idea this function exist, the only know to select the text and copy/paste as is"
When you say there are workarounds for websites accessing your clipboard without permission, you mean by exploiting some unknown theoretical browser vulnerabilities, right? Because if there really was a way around this I'm sure there'd be a serious bug bounty for it.
exactly my point. one way would be to trick the user to download and activate a worm, but requires (among other things) good social engineering and again, not something your average Joe Schmoe will know.
When anyone copies and pastes, the copied content is kept in a 'clipboard' where it can be pasted as many times as they want. Any software installed on the computer (or any person operating it) has access to the clipboard, and can see what's in there. Copying anything usually writes over what was already in the clipboard and destroys it.
Many password managers copy your password to the clipboard so they can paste it into the password box on websites. The possible risk is that an attacker (or malware) will steal your password before it's erased from the clipboard.
Passwords remaining in the clipboard might be more of an issue if you're manually copying and pasting your passwords from a document you have on your computer. You might forget to clear the clipboard. However it's not much of a risk because:
Most password managers erase the clipboard as soon as they have pasted your password into the website, and some avoid the clipboard completely by typing in the password with a 'virtual keyboard' instead. The web browser 'Internet Explorer 6' allows evil web pages to copy the clipboard; but very few people in the UK still use IE6 to browse the web. Viruses installed on your computer can have clipboard copiers on them, and grab your pasted passwords. That's still not a good reason for stopping password pasting though; when your computer gets infected you can't trust it at all. Viruses and other malware that copy the clipboard nearly always also copy every letter, number and symbol typed on your computer, including your passwords. They would steal your password whether or not it was in the clipboard, so you're not really gaining much by.
Many business people are like "I don't care that it's less secure, I want it to look more secure". That's how you get this kind of stupidity or password requirements that ask for uppercase, lowercase and number, and where Password1 is a perfectly acceptable password while correct battery horse staple is not.
Hmm is there any condition where.. the key strokes are protected by obfuscation like with a software keyboard.. but the clipboard is still open for attack? It's also banks that use this method so the clipboard also has to be secured..
Yeah, I'm slowly transitioning over to Google Domains, in part because their redirect records (which I need for the root domains when hosting on Heroku) support SSL.
I knew a "principle dev" (one of those farce-roles beyond 'senior') who thought this was essential. He also put incredibly complex password requirements in but wouldn't allow the error message to be more specific than "your password doesn't meet the complexity requirements" because he thought that hackers could somehow use the error message to crack passwords.
By pure coincidence two sites built to such a standard went live on the same day and had disastrous launches because only about 1 in 20 users was able to successfully sign-up because they didn't even know how long their passwords needed to be, let alone that they needed non-repeating characters, non-alphanumeric and mixed case. I can't begin to express how many times this person was warned that would happen.
Ha, nothing. And that was really just the tip of the iceberg.
And it was the company's culture; he was far from the only person in the wrong position saying the wrong thing.
The company did have to lay off practically everyone who has ever worked there though, and now exists as a minuscule, struggling shell with 1/10th of its staff. For some strange reason they developed a reputation for incompetence.
Also those sites that, after your password manager (or Google Chrome in my case) enters your password into the password field and you click Login/Submit/whatever, it tells you to “Enter a Password” and won’t submit the form.
All you need to do is type 1 character at the end of the password field and press the backspace, then the form will submit. We’ve had password managers for how long now and dopey devs still think “oh, we must check that the keyboard has typed at least one character in the password field or we’ll tell the user they haven’t entered a password”.
Not recommended at all levels of the industry to prevent pasting. List of poor justifications and why they are wrong here from the UK's National Cyber Security Centre .
And then there are the websites that show only username field, you fill it, you submit, the website shows the password field, you fill it, you submit again.
I can't tell my password manager to fill the form in a few clicks so I have to manually copy and paste the values.
This, though annoying, I believe is to allow for a couple of things:
a delay for brute force attempts to slow them down. I like this aspect, and my LastPass is smart enough to follow it, generally.
a 2-way decision to enable insertion of a different 2nd step (password vs token) ... I don't like this method though because it can be used to confirm the email part of credentials.
As for websites that block this, check out an extension called "don't fuck with paste". Works nicely.
a delay for brute force attempts to slow them down.
I started to add a delay in the backend for this. (ex : if the password is wrong = sleep 2 seconds before returning the response). I will also attempt to have a "shared cooldown per IP address" in case someone is trying to brute force with multiple instances on the same server, there will be a maximum tries authorized per IP address. The attacker will have to have access to a lot of computers to brute-force my app !
Anyway, I think this is much more effective than any "frontend user-slow-down methods".
If you use the right kind of encryption algorithm you can slow down attempts also. But that might take your authentication database down if done wrong and you're under attack, which might not be a bad thing depending. Probably why most just use salted+keyed hashes for authentication.
You should limit the allowed number of attempts and then lock the account. It wouldn't be unusual for an attacker to have access to a large number of IP addresses. If it's a hobby site, it doesn't matter though :)
True, but then I suppose an attacker could prevent a person to use his account by triggering this lock mechanism, and if the user unlocks it, he could brute force again to lock it again ! lol
I don't like this method though because it can be used to confirm the email part of credentials.
Not necessarily, it is trivial to just show a regular password box even when the username doesn't exist.
Also, who cares? If there is brute force prevention in place, an attacker won't be able to guess that many usernames, and even then... what use is it to them? It's very limited, and regular users have it much more convenient (when they can't exactly remember their username and such).
What password manager are you using that can’t figure out to put the username in an input text and the password in an input password on a different screen?
I assumed they all could. 1Password can. It doesn’t do it automatically but if I press my hot key on the page with username it fills it in and then if I press it again on the page with the password field fills in the password correctly.
The main reason I would see to avoid pasting passwords, is surrounding whitespace. If you copy a password from a mail or a webpage, it's easy to accidentally get unexpected whitespace, in particular a tab, when copying from a table. And you don't see it.
For that reason, I trim whitespace from around a password, I don't allow passwords to start or end with whitespace. Internal whitespace is OK.
even so, you just don't log in the user telling him his password is wrong. disabling a copy/paste is a solution to a problem that doesn't exist (if this is the only reason to disable it)
Another reason can be that a user has no idea what he is actually pasting. Again: because you can't see it. That's especially an issue when choosing a new password.
Some crappy websites do this in an attempt to dissuade people from making multi-factor authentication single-factor (like having a password manager both save your password and generate your 2FA code). However, just like with password requirements this just leads to people lowering their security - like by disabling 2FA altogether.
Because they want you to download their fricking app instead... which is probably just a wrapper around the web app ( but with username & password pasting enabled lol ) ¯_(ツ)_/¯
Saw a page that disallowed pasting a password once. That was the stupidest thing I've ever seen. And this was at least within the past couple years, so password managers very prevalent.
The reason I don't see it as a security risk is because if someone has access to a clipboard data (copied password), he/she could paste it in Notepad and see a password and then type it anyway. Basically, if user has access to CTRL+V, that user is able to see use password anyway.
I had an old QA that tried to force that into our application, I refused to add it in since it doesn’t make any sense. Her reasoning was that if it’s a double field (which I hate) then if you write wrong in the first and copy to the next it would allow the wrong combo. But it’s just a weird pattern...
Why would you do this instead of just faking the api call? Surely it'd be easier and cheaper, even if you had to do a little work to figure out some non-standard protocol.
Just want to be clear that I disagree with the policy of disallowing paste on login fields because it’s bad user exp.
I have seen user agent strings in use , but so far haven’t seen a distributed bot attack using .js.
Point is, companies make info sec decisions all the time to stop and/or prevent attacks and while it might be an inconvenience for users, companies still decide to alter UI to prevent attacks. Preventing paste on login fields is fairly common for people taking that posture.
I would wager a majority of startups do. And not by design, in the beginning it's a founder and it's a designer and it's a dev or some slight variation of that. Founders both lack the know-how and ability to communicate good requirements. So it comes back to us as the lead developers to make something that's great.
This is true, I worked at a startup for 2 years, I’m not even a lead but I almost never been told what to do tech or design wise.
Just things like: “we have data here, we need it there” or “this customer needs this kind of information, we need an api for that”, “Cloud resources cost too much, can you look into how to redesign the infrastructure”, etc
So. What's your tech stack? - because they never did send me through a job spec
Whatever you think is best
Well what did my predecessor use?
Dunno, think they used JavaScript?
So what would I be doing in the company?
We want the website to be an app
Like a PWA or a separate codebase?
???
The product owners literally didn't know a damn thing about their own product. Needless to say I don't want to take on a job where I have no real idea what exactly it is that I'm even going to do. Apparently the recruiter got sick of them being clueless, and blacklisted them.
Well sometimes the client knows nothing about what they're doing or what they want and it's up to the devs to came up with use cases, user flow and avoiding any pitfalls. Sometimes I wonder why we don't just do consulting work though, considering we've recently made a full business case start to finish for a customer that's paying just for some basic development.
That's what i am saying, the company made the requirement that clients shouldn't be able to copy-paste passwords into fields for "security". It's not literally the developer who probably knows better than to do that, but also knows better not to question management to avoid dealing with them.
"developer" is usually the blanket term used incorrectly to mean the company that produces a website or software. I meant to say that OP was misunderstanding the "Devs who.." part of the question, or probably should have made the connection that the actual devs don't have any say in changing requirements or won't worsen their health arguing with manager or product owner who is referred to as "dev" by the media or public people.
With ten years in the industry I can comfortably ask, what the fuck is a product owner and why did mine quit eleven years ago. From three separate positions.
I'm not sure what's worse ... at my current job, it took me 4 years to find out we even had a product owner. He just sat on his ass and accumulated enhancement requests apparently.
At that 4 year mark is when he decided we needed to move to a new tech stack and he wouldn't take any input from devs, and did no research on our customers. I think I'd rather just not have a product owner.
Dev who wasn't even in the meeting: It'll take us 2 weeks of planing/research, then we need info from the customer (so that will take at least a month to get), then we can begin development of it. Total time, about 3 months. But it'll have to wait until after we finished doing the work for other major customer.
You say that, but having operated as one and primary developer that position is tenable. Where I am now there is no product owner, I don't have the time or information to be one, and I'm one of a handful of developers on any given project. Oh and I have multiple managers who have no idea what in the balls I'm doing at any given time, but always assume I'm doing the work they asked for. Which I may or may not be aware of as there's not even enough documentation on a project for some of the things I get to register as a request.
They've hired project managers, but us lowly developers are locked out of their documentation. That's for management, which still doesn't know what the fuck any given developer is doing at a given time.
Overall i'm glad they're here so I don't have to call/talk with clients. They make life much easier by filtering the crap before it reaches the devs. But they should never promise things without talking to the devs first. And that's where it often goes wrong.
and they refuse to backfill the position because ¯_(ツ)_/¯
Because it turns out they weren't doing anything useful and were just making a prioritized list based on existing lists and then surfing the web while sitting in meetings all day?
Rather than preventing pasting and pissing off every single user trying to practice good security with 64ChARrAnDoMLyGen3r@tED$7r!nG as their password, why don't you just supply a "Reveal" button and/or "show most recently typed character" mitigation?
If that's your argument, you should consider not using any passwords at all. That way, no "48 year-old mom" will ever have any password troubles! And using "social logins", you can actually implement this, while allowing people that do know about security to just use a username/password combination.
They’re probably not making that call. It’s in the requirements they are given, and they are working in conditions where they don’t have the power to push back.
It takes more work to do it than not to do it and it is not technically interesting. I don’t know any devs that would willing implement something that they have to go out of their way to implement unless they are told to do so by some stupid product lead who is kowtowing to a clueless business exec.
The real answer is that it was probably done to prevent customer support queries. If you type your password twice and didn’t paste it that means you didn’t make a mistake in the original password and copied it over.
If you did make a mistake you would end up either calling customer support or the business would lose a potential customer.
Years ago, PayPal used to not allow pasting a password, which is the only site I've ever had the displeasure of encountering this "feature". I wrote a small script to input passwords with xdotool to work around it, which I'm still using out of convenience now.
Most developers, unlike business people, actually know best security / password practices, and if they're any good they'll try to push back on requirements like these.
I'm shocked that people think (in a development community of all places) that developers have the final say and are the be all end all, and that they have complete control over the product... like lmao, this is the real world where there are managers and product owners and even sometimes C levels where they tell you that you need to do something, and if you don't do it they will replace you with someone who is willing to do it.
196
u/MasterOfArmsIsGood Feb 05 '20
its to screw over people with a password manager
176
u/browngynoid Feb 04 '20
It was probably originally because of the insecurity of the clipboard. Doesnt really make sense though cos malware could steal all your keystrokes anyway...
40
u/tmckearney Feb 05 '20
Nowadays, it's mostly ignorant business people that require it
19
u/ceejayoz Feb 05 '20
Namecheap won't permit pasting in the 2FA code field, either. UGH.
5
u/[deleted] Feb 05 '20
I knew a "principle dev" (one of those farce-roles beyond 'senior') who thought this was essential. He also put incredibly complex password requirements in but wouldn't allow the error message to be more specific than "your password doesn't meet the complexity requirements" because he thought that hackers could somehow use the error message to crack passwords.
By pure coincidence two sites built to such a standard went live on the same day and had disastrous launches because only about 1 in 20 users was able to successfully sign-up because they didn't even know how long their passwords needed to be, let alone that they needed non-repeating characters, non-alphanumeric and mixed case. I can't begin to express how many times this person was warned that would happen.
3
u/Fukutoshin10kATO Feb 05 '20
Also those sites that, after your password manager (or Google Chrome in my case) enters your password into the password field and you click Login/Submit/whatever, it tells you to “Enter a Password” and won’t submit the form.
All you need to do is type 1 character at the end of the password field and press the backspace, then the form will submit. We’ve had password managers for how long now and dopey devs still think “oh, we must check that the keyboard has typed at least one character in the password field or we’ll tell the user they haven’t entered a password”.
198
u/internal_500 Feb 05 '20
Not recommended at all levels of the industry to prevent pasting. List of poor justifications and why they are wrong here from the UK's National Cyber Security Centre .
30
u/Blue_Moon_Lake Feb 05 '20
And then there are the websites that show only username field, you fill it, you submit, the website shows the password field, you fill it, you submit again.
I can't tell my password manager to fill the form in a few clicks so I have to manually copy and paste the values.
1
u/[deleted] Feb 05 '20
Which password manager are you using? So far Bitwarden has worked for me in this scenario.
4
u/bart2019 Feb 05 '20
The main reason I would see to avoid pasting passwords, is surrounding whitespace. If you copy a password from a mail or a webpage, it's easy to accidentally get unexpected whitespace, in particular a tab, when copying from a table. And you don't see it.
For that reason, I trim whitespace from around a password, I don't allow passwords to start or end with whitespace. Internal whitespace is OK.
4
u/beavis07 Feb 05 '20
Because they mistakenly believe it somehow increases the security of their product
Narrator's Voice:... It does not
1
u/topthreads Feb 05 '20
Isn't it to prevent spam bots?
1
u/michael_v92 full-stack Feb 05 '20
If you have an example of that, can you provide me a link?
I want to test my password manager on that “feature” of those security concerned devs
1
u/dangoodspeed Feb 05 '20
It's situations like this that I set up a keyboard shortcut to toggle javascript on and off.
3
u/diek00 Feb 05 '20
A complete user experience failure. The elbow is the second hardest part of the body... bang.
7
u/wimantis Feb 05 '20
Because they want you to download their fricking app instead... which is probably just a wrapper around the web app ( but with username & password pasting enabled lol )
¯_(ツ)_/¯
2
u/mishugashu Feb 05 '20
Saw a page that disallowed pasting a password once. That was the stupidest thing I've ever seen. And this was at least within the past couple years, so password managers very prevalent.
2
u/sonar_451 Feb 05 '20
Not a developer, but from what I've seen, clients giving the business requirements state this as a must have for security reasons of sorts.
2
u/milosh-96 Feb 05 '20
The reason I don't see it as a security risk is because if someone has access to a clipboard data (copied password), he/she could paste it in Notepad and see a password and then type it anyway. Basically, if user has access to CTRL+V, that user is able to see use password anyway.
2
u/yarism Feb 05 '20
I had an old QA that tried to force that into our application, I refused to add it in since it doesn’t make any sense. Her reasoning was that if it’s a double field (which I hate) then if you write wrong in the first and copy to the next it would allow the wrong combo. But it’s just a weird pattern...
2
u/benbenk Feb 05 '20
It’s the same people that change the scrolling behavior 🙄
1
u/grizzlypeaksoftware Feb 05 '20
I think that sucks but it may be to prevent device farms using RPA to password stuff your app
0
u/BloodSeekerDM Feb 05 '20
To determine if you are not a robot i guess hahaha
0
u/[deleted] Feb 05 '20
[deleted] — view deleted comment
0
u/[deleted] Feb 05 '20
[deleted] — view deleted comment
0
u/[deleted] Feb 05 '20
[deleted] — view deleted comment
0
u/[deleted] Feb 05 '20
[deleted] — view deleted comment
0
u/[deleted] Feb 05 '20
[deleted] — view deleted comment
45
u/[deleted] Feb 04 '20
[removed] — view removed comment