It’s 2023, why are websites actively preventing pasting into fields like passwords and credit card number boxes? I use a password manager for security, it’s recommended by my employer to use one, and it even avoids human error like accidentally fat-fingering keys, and best of all with the credit card number I don’t have to memorize anything or know a single digit/character!
I have to use the Don’t Fuck With Paste addon just to be able to paste my secrets into certain monthly billing websites; why is my electric provider and one of my banks so asinine that pasting cannot be allowed? I can only imagine downsides and zero upsides to this toxic dark-pattern behavior.
There is even a mention about this in NIST SP 800-63B, a standard for identity management that some companies must follow in the USA, which mentions forcefully rotating passwords and denying “password paste-in” as antiquated/bad advice:
Verifiers SHOULD permit claimants to use “paste” functionality when entering a memorized secret. This facilitates the use of password managers, which are widely used and in many cases increase the likelihood that users will choose stronger memorized secrets
Edit: I discovered that for Firefox users there’s a simpler way than exposing your secrets to someone’s third-party addon. Simply open about:config, search for dom.event.clipboardevents.enabled, and change it from true to false.
these days password managers clear the clipboard, still the clipboard is not secure which would be why some still block it.
really its an indication we need to drop User/Pass auth once and for all.
Which has always been an asinine point of view. By the time a site has blocked the paste the password is already in the clipboard. No security has been added in that regard, only frustration.
What’s a suitable replacement here?
Webauthn looks cool
I use it where it’s available, with a couple of Yubikey 5s. It’s the best solution I’ve come across.
Wish it would be used in more places. Websites in 2023 just now adding OTP with SMS/email is embarrassing. Why would they jump to 10+ year old, insecure tech?
Google, Apple, and Microsoft are working on Passkeys. I don’t know the security behind it, but so far it’s been great for the few sites that support it.
“Passkeys” is just a marketing term for Webauthn.
The system mentioned by Established here is called VRF, there is also technology called Self-Sovereign Identity aka DiD (a w3c standard)
To keep it simple, essentially we are moving to authenticators using systems that are similar to how a website identifies itself and secures your connection. For the user it will still be mostly the same, unlock device, unlock data (which I bet in some cases will STILL be password during the transition) do your thing. As time goes on and things like identity keys that we carry with us become a thing (think like a fancy version of the electronic door cards).
In general it will be much easier and less an issue to get into most systems and all of your accounts become more secure as we move away from having any data on the provider that could be used to reconstruct your password. Ofc all of this is still a bit away from being fully realized, expect rollouts to become more serious by the end of the decade.
Wouldn’t that not be great for privacy?
this is not dissimilar to how high security setups work for organizations now, really what this is is a scaling up of the kind of things IT administrators are already doing when locking down production among other systems (its a very common login pattern for Linux based systems for thier SSH terminals).
The big difference here is that your password changes from a password to a digital signature bound to time, hardware and the user. If the user so chooses they can always put a many levels on top of that that they want, be it passwords, additional keys, biometrics, what-have-you.
Since your credentials never leave your device data breeches do not compromise your account or access to it (only the data the provider failed to protect). This also enables even higher levels of security through the whole credential chain, want to end-to-end-encrypt your data and encode it with your own cipher while storing it in the providers database? This is not only possible it will end up changing how we develop some applications. As a developer I just want to give you the utility, if I can ensure strong encryption that I NEVER have access to, its a whole boat of liability I don’t even have to worry about.
In short we are taking the mechanics of auth and making it entirely cryptographic with keys without any worry about compromising a simple text input box. The possible combinations of certificate data and system parameters alone increases the difficulty of a breech through login significantly.
It will not stop everything of course, and the usual risks around a bad release, a failed audit and an admin bypassing things knowing or unknowingly are all still problems.
The other thing this enables, should it get that far, decentralized replacement of Google/MS/Amazon auth systems many of us MUST gate our sites with, youll be able to accept logins from multiple systems without ever having to write any new code. As the standard becomes adopted and supported firing up a site with all the usual traditional logins combined with the more-modern cert-style setup will no longer be a game of dealing with app setups and IAM, you can just load and go.
Example of difference here: I could paste my public key to my prod systems here on lemmy and it would not change a thing about access to my systems, no one with the key or any of my signatures could do anything. With certificate based auth we know both sides of the transaction as well so MITM is not a thing in most scenarios.
Thank you for the detailed reply. I just had other things in mind. For important things, sure, but I kind of appreciate the ability to give some website a username, password, and maybe an email and that’s all the ask.
I know IPs and browser fingerprinting kind of make this moot anyway.
you won’t even give them that in this kind of system. you will get a user hash that is based of your signature, the system your using’s key and some mux of time and entropy input. This hash will be how they track you in a database and as systems evolve could even be a way to communicate with the user directly (like email) without knowing or holding any PII/NPI
Anything you assign to them would be data they have (maybe a common display name). Anything truly important that needs to be up there can be encrypted with different techniques that would allow the provider to work with your data without ever having to access or decrypt your data.
so the idea of them “needing to have something” to function is true, but fundamentally, they don’t need as much to operate in this system and its possible to have standards that enforce security on your more sensitive details that are sent. Imagine the security of your data, on thier system, still being ruled by your security. Even if hackers get in and copy the entire database its effectively useless.
Passkeys
some sites like Walmart are removing the password requirement completly in favor of OTP, mcdonalds does the same, you type your email/phone number it sends you a link and you click the link to gain access. I wouldn’t recommend that for a bank site but, a low risk site? why not.
I find that setup an obnoxious user experience. Instead of one hotkey that tells my password manager to fill out the login form, now I have to switch to my mail app, wait for the login email to arrive (if my mail provider or the site’s mail provider is having trouble, no login for me!) then back to my browser where I need to close the original tab because clicking the email link opened a new one.
If I am on a shared computer, now I need to either manually copy a long URL from my phone or read my email on that computer, a much bigger security risk than just entering a password and 2FA code.
This is an especially jarring experience when using a phone or mobile device, due to all of the task switching back and forth as mentioned.
I find OTP and 2FA both obnoxious. Webauthn needs to become standard.
Passkeys. Google already supports them. Freaking amazingly easy.
Passkeys 4 lyfe.