this post was submitted on 19 Jul 2023
742 points (98.2% liked)

Asklemmy

43856 readers
1784 users here now

A loosely moderated place to ask open-ended questions

Search asklemmy 🔍

If your post meets the following criteria, it's welcome here!

  1. Open-ended question
  2. Not offensive: at this point, we do not have the bandwidth to moderate overtly political discussions. Assume best intent and be excellent to each other.
  3. Not regarding using or support for Lemmy: context, see the list of support communities and tools for finding communities below
  4. Not ad nauseam inducing: please make sure it is a question that would be new to most members
  5. An actual topic of discussion

Looking for support?

Looking for a community?

~Icon~ ~by~ ~@Double_A@discuss.tchncs.de~

founded 5 years ago
MODERATORS
Cloak@lemmy.ml
mekhos@lemmy.ml
tmpod
14specks@lemmy.ml
742
Why do sites disable pasting in password fields? (lemmy.ml)
submitted 1 year ago* (last edited 1 year ago) by Caaaaarrrrlll@lemmy.ml to c/asklemmy@lemmy.ml
191 comments fedilink hide all child comments
 

It's 2023, why are websites actively preventing pasting into fields like passwords and credit card number boxes? I use a password manager for security, it's recommended by my employer to use one, and it even avoids human error like accidentally fat-fingering keys, and best of all with the credit card number I don't have to memorize anything or know a single digit/character!

I have to use the Don't Fuck With Paste addon just to be able to paste my secrets into certain monthly billing websites; why is my electric provider and one of my banks so asinine that pasting cannot be allowed? I can only imagine downsides and zero upsides to this toxic dark-pattern behavior.

There is even a mention about this in NIST SP 800-63B, a standard for identity management that some companies must follow in the USA, which mentions forcefully rotating passwords and denying "password paste-in" as antiquated/bad advice:

Verifiers SHOULD permit claimants to use “paste” functionality when entering a memorized secret. This facilitates the use of password managers, which are widely used and in many cases increase the likelihood that users will choose stronger memorized secrets

Edit: I discovered that for Firefox users there's a simpler way than exposing your secrets to someone's third-party addon. Simply open about:config, search for dom.event.clipboardevents.enabled, and change it from true to false.

Edit 2: As some have pointed out, that config value interferes with regular functionality on some sites. Probably best to leave it alone unless you know what you're doing.

you are viewing a single comment's thread
view the rest of the comments
[–] inetknght@lemmy.ml 10 points 1 year ago (3 children)

KeePass has an auto-type feature. It basically presses keystrokes right into the input field.

I never have to worry about sites disabling pasting into fields because:

  • I use about:config to disable clipboard manipulation
  • I use KeePass auto-type to type passwords instead of copy-pasting them

Also, putting your password on your clipboard is Bad Practice because any application (including a javascript web page) can inspect your clipboard

[–] jeena@jemmy.jeena.net 4 points 1 year ago (1 children)

I have written important passwords into chat windows too many times to use the auto-type function. In my case it's much worse to use autotype because the UI isn't obvious into which window it will autotype and press enter to send the message to everyone. At least with the clipboard I have to press the enter myself when I see I pasted it into the correct field.

But to get around that I'm actually storing my password in the browser too and syncing them between my firefox instances with my self hosted sync server.

[–] RIP_Apollo@feddit.ch 3 points 1 year ago

Yes I’ve made a similar mistake in the past. On one screen I performed the auto-type and it was in the process of typing out the user/password combination, and while this was happening I clicked into a chat window on my other screen without thinking. The chat window immediately started having part of my password typing into it!

Luckily I managed to click elsewhere in time to prevent ‘enter’ being typed at the end of auto-type.

It’s just a reminder that you have to wait for auto-type to complete before you can do anything else.

The UI isn't obvious into which window it will autotype

I found that if you click into the username field first and then switch directly to KeePass without opening/switching to any other applications in between, then when you click auto-type in KeePass, it works every time. This is because the browser window was the last used application before KeePass was selected. But yeah, it’s not an ideal user experience.

[–] UlrikHD@programming.dev 1 points 1 year ago (2 children)

What plug-in is it and does it work with Firefox? I had a plug-in that worked with chrome, but it didn't work with Firefox and I never got around to fixing it.

[–] inetknght@lemmy.ml 1 points 1 year ago

I don't use a plugin. I use a separate app. So I can type passwords into terminals or games too. ;)

[–] RIP_Apollo@feddit.ch 0 points 1 year ago (1 children)

I could be wrong because I haven’t used KeePass in a few years… but it’s my understanding that the auto-type feature doesn’t work on every website, depending on how they’re designed.

So auto-type will work on websites where the username input field and password input field are on the same page, and where you can switch from the username field to the password field with a single tab key press.

However I don’t think it will work on sites where the username needs to be submitted first before the password field is even visible. I think signing into a Google account is an example of this.

At least that was my experience when I was using KeePass a few years ago. Please correct me if I’m wrong.

[–] inetknght@lemmy.ml 2 points 1 year ago (1 children)

The only app that won't let me use KeePass autotype is Planetside 2's launcher. I've never had any trouble in any other app with KeePass's auto-type feature -- including to log in to Google.

If a site is asking for a username first, then I can auto-type the username too ;)

[–] RIP_Apollo@feddit.ch 1 points 1 year ago

Ah ok, thanks for letting me know. I haven’t used KeePass in a long time but I’m going to download it and give it another try now. It sounds like a good idea to avoid passwords from being stored in the clipboard. Thanks.