this post was submitted on 19 Jul 2023
742 points (98.2% liked)

Asklemmy

43498 readers
2059 users here now

A loosely moderated place to ask open-ended questions

Search asklemmy πŸ”

If your post meets the following criteria, it's welcome here!

  1. Open-ended question
  2. Not offensive: at this point, we do not have the bandwidth to moderate overtly political discussions. Assume best intent and be excellent to each other.
  3. Not regarding using or support for Lemmy: context, see the list of support communities and tools for finding communities below
  4. Not ad nauseam inducing: please make sure it is a question that would be new to most members
  5. An actual topic of discussion

Looking for support?

Looking for a community?

~Icon~ ~by~ ~@Double_A@discuss.tchncs.de~

founded 5 years ago
MODERATORS
Cloak@lemmy.ml
mekhos@lemmy.ml
tmpod
14specks@lemmy.ml
742
Why do sites disable pasting in password fields? (lemmy.ml)
submitted 1 year ago* (last edited 1 year ago) by Caaaaarrrrlll@lemmy.ml to c/asklemmy@lemmy.ml
191 comments fedilink hide all child comments
 

It's 2023, why are websites actively preventing pasting into fields like passwords and credit card number boxes? I use a password manager for security, it's recommended by my employer to use one, and it even avoids human error like accidentally fat-fingering keys, and best of all with the credit card number I don't have to memorize anything or know a single digit/character!

I have to use the Don't Fuck With Paste addon just to be able to paste my secrets into certain monthly billing websites; why is my electric provider and one of my banks so asinine that pasting cannot be allowed? I can only imagine downsides and zero upsides to this toxic dark-pattern behavior.

There is even a mention about this in NIST SP 800-63B, a standard for identity management that some companies must follow in the USA, which mentions forcefully rotating passwords and denying "password paste-in" as antiquated/bad advice:

Verifiers SHOULD permit claimants to use β€œpaste” functionality when entering a memorized secret. This facilitates the use of password managers, which are widely used and in many cases increase the likelihood that users will choose stronger memorized secrets

Edit: I discovered that for Firefox users there's a simpler way than exposing your secrets to someone's third-party addon. Simply open about:config, search for dom.event.clipboardevents.enabled, and change it from true to false.

Edit 2: As some have pointed out, that config value interferes with regular functionality on some sites. Probably best to leave it alone unless you know what you're doing.

you are viewing a single comment's thread
view the rest of the comments
[–] finch@lemm.ee 3 points 1 year ago (1 children)

Care to share the setup/script for this?

[–] erogenouswarzone@lemmy.ml 0 points 1 year ago (2 children)

So the best thing to do is to not store your password in plain text, and there are many discussions on the best way to do that on the AHK forums, so I won't go into it,

But I will say the way I have found that is best for separation of passwords from AHK is to use windows environment variables.

So go into env variables and make a new one called something like "googlepw" and it's value should be your Google password.

Then in the script you can just call them as if they're defined in the script:

#g:: Send text %googlepw%

(I'm on mobile, so you may have to monkey around with quotes to get that to work)

[–] taladar@sh.itjust.works 3 points 1 year ago

That will include your password into any debug report of any application that includes the environment in the debug report (most) and in general all applications will have access to it.

[–] protput@lemmy.world 1 points 1 year ago

I also use AHK for this. But I just send the clipboard variable.