It’s 2023, why are websites actively preventing pasting into fields like passwords and credit card number boxes? I use a password manager for security, it’s recommended by my employer to use one, and it even avoids human error like accidentally fat-fingering keys, and best of all with the credit card number I don’t have to memorize anything or know a single digit/character!

I have to use the Don’t Fuck With Paste addon just to be able to paste my secrets into certain monthly billing websites; why is my electric provider and one of my banks so asinine that pasting cannot be allowed? I can only imagine downsides and zero upsides to this toxic dark-pattern behavior.

There is even a mention about this in NIST SP 800-63B, a standard for identity management that some companies must follow in the USA, which mentions forcefully rotating passwords and denying “password paste-in” as antiquated/bad advice:

Verifiers SHOULD permit claimants to use “paste” functionality when entering a memorized secret. This facilitates the use of password managers, which are widely used and in many cases increase the likelihood that users will choose stronger memorized secrets

Edit: I discovered that for Firefox users there’s a simpler way than exposing your secrets to someone’s third-party addon. Simply open about:config, search for dom.event.clipboardevents.enabled, and change it from true to false.

  • dom@lemmy.caEnglish
    422·
    1 year ago

    Because people would write down their passwords? I wonder how many people use their browser’s built in password manager

    • chinpokomon@lemmy.mlEnglish
      29·
      1 year ago

      That’s one way it is weaker, but moreso because it reduces the entropy. If a user can provide a password which uses 26 letters, upper and lowercase, 10 numbers, and an unrestricted set of symbols, but for the sake of argument we’ll say 10, then there are a lot of possible combinations. If you are limited to only 12 possible at max, it is 46^12. Now you impose an artificial requirement that it is one of each, then it actually weakens that further by making the hacker know that there is one of each in there so it is 26+26+10+10+46^8. Or roughly 910^19 vs. 210^13. I personally try to use passwords which are between 16-20 characters long, or roughly 2*10^33. By restricting the total number of characters and forcing specific combinations, then the password is significantly less cryptographically sound.

      Using this calculator, https://bitwarden.com/password-strength/, it is a difference of 3 hours vs. centuries using the bank’s mandate vs. only lowercase and 20 characters.

      • dom@lemmy.caEnglish
        71·
        1 year ago

        The 20 character requirement is kind of a huge component though.

        Sure. Banks should be enforcing that instead of special characters. But the vast majority of people would just choose “football” or “password” as their passwords if they weren’t required to do something more complex.

        I disagree with the argument that it’s less secure to require symbols in passwords as a blanket statement . It’s less secure to require symbols in passwords than if you are also enforcing much longer minimum passwords as well.

        • zzz@feddit.deEnglish
          3·
          1 year ago

          Sure. Banks should be enforcing that instead of special characters. But the vast majority of people would just choose “football” or “password” as their passwords if they weren’t required to do something more complex.

          Ironically though, something like

          IveLovedUsingFootballAsMyPassword!EverSinceThe1980s.

          as a password would be miles ahead of even the most random character combination possible, but which is only 12-20 characters long.

          And as an added bonus, the above example is practically guaranteed to have never been used before, in addition to being correct horse battery staple (that is, tremendously easy to remember).

          I hate when a website/app in this day and age imposes an absurdly low upper password character limit like 30. (cough looking at you, PayPal, when I re-set my password a few years ago it was freaking 20, not exaggerating).

          Shouldn’t password length below like 100 (or realistically, any length until it starts crashing the js behind it?) not matter anyways, since it’s all salted, peppered and hashed before further processing anyways?

          • evatronic@lemm.eeEnglish
            5·
            1 year ago

            There is no technical reason for there to be a maximum length on the user’s password.

            Watch:

            Here’s a password bitwarden generated for me:

            Bonded-Reforest-Prenatal7-Spoken-Straggler-Catcall

            Here’s the base64-encoded SHA3-512 hash for that password:

            Q2WaVLdTAg5T4xi3VB5PMI7GkAv3np9Usa2+uTMglbMcDDAdYXzUNgAzzYLoSWku/e007vkKfvSotzoriSKt4Q==

            Here’s the has for the password password:

            6adUhnNqVQr0/qhh4jeDBcSlVaBQlN7h3KL2iv6knMOlDo3m6hMepSExH01vsFShRugoL441/y5jaMGmLpCXFg==

            Notice how the thing the website should be storing in their database is exactly the same length, regardless of the input?

            For extra fun, here’s the hash for your sample password:

            GbxnrQ31PInMSu2ik2ZR5TefgXIInSJBxZ5zwcYmkRxzw07tZoxPqJbEmcbuTBpzCZzwLrqqcxz04p8ToGszRQ==

            Here’s a tool to generate your own hashes: https://www.liavaag.org/English/SHA-Generator/

            • r1veRRR@feddit.deEnglish
              4·
              1 year ago

              I mean, if we’re being pedantic, there’s a reasonable technical limit once the password reaches multiple MBs of data.

              But yes, there’s no good reason for the actual limits we’re seeing out in the wild.

              • zzz@feddit.deEnglish
                1·
                1 year ago

                I mean, if we’re being pedantic, there’s a reasonable technical limit once the password reaches multiple MBs of data.

                But yes, there’s no good reason for the actual limits we’re seeing out in the wild.

                Yes @evatronic, this is of course what I meant with “except if the js starts crashing maybe”. I’m aware that hashes end up with the same length, no worries 😄