Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I use a few websites that prevent me from copying & pasting into the username or password fields. It's quite frustrating when using a password manager, and if anything I'd think it discourages users from good password-management because they're going to have to choose something they can type manually over and over again.

Are there actually any benefits to preventing the paste operation on an application or website?

share|improve this question
    
Can you characterize the sites, or name them? Are they trying to protect something of real exchange value, or are they just idiosyncratic? –  nealmcb Mar 6 '11 at 3:46
1  
The registration page for the BlackBerry Beta Zone does this: blackberry.com/beta –  Luke Girvin Jul 26 '11 at 10:00
add comment

3 Answers

up vote 8 down vote accepted

In my opinion, I don't think it's a net win. Those restrictions always frustrate me.

(I'm hoping someone here will post details about how to defuse or work around them. Maybe a tweak to Firefox's user_prefs.js? An extension?)

Presumably the reason why sites disable the password manager is because they're worried that Alice might sit down in front of Bob's browser and log into the web site as Bob, maybe purchasing something on Bob's tab. This is particularly an issue for roommates, family members, etc. who live together with each other. (See also "friendly fraud".) A related risk is that Bob might actually purchase something, but then claim that Alice did it to get out of paying for it. Presumably, the sites hope that by disabling the password manager, Bob will be forced to type in his password anew every time; Alice won't know the password and won't be able to type it in.

However, these restrictions come at a significant cost. They make the website less usable and more annoying for users. They also drive users to either select poor passwords (which may be more susceptible to password-guessing attacks) or to write down their passwords (potentially enabling roommates and family members to learn the password, leaving everyone back where we started). For users who do trust everyone else who has physical access to their computer, these restrictions strictly decrease security.

Personally, I suspect most sites should be reluctant to employ such measures. Odds are that you will annoy your users more than you will help them. But you will be in a better position to make an informed decision.

If you do decide to employ such restrictions, you might consider providing users a way to opt out if they do not share their computer with others. Perhaps this may only be of interest to power users, so I don't know if it's worth your time, but you could consider it.

share|improve this answer
add comment

I personally don't think there are any real benefits. I'm agreeing with the idea that you'll probably just annoy your users into picking something that isn't helpful.

That said, I believe the rationals used are either to avoid the password being saved somewhere where it might be stolen, or because they believe passwords must be typed by the user for irrational reasons. While it might be rational that it could defend against Little Johnny emptying his mother's bank account, I don't see much else in practicality. I figure if you can snag the password file, you can probably snag the keyboard input.

share|improve this answer
add comment

The two core reasons always indicated to me are:

  1. Allowing copy and paste means people will have their passwords saved in a text file somewhere, which is unsafe (yes, I know with applications like PassSafe this is a bit outdated, as the place to save passwords is 'safe')
  2. People wll forget their passwords if they don't have to remember them.

Number 2 is the most important one, I think - it's hard enough persuading people to remember their passwords when they get back off holiday - the helpdesk load is high after any major holiday, and companies try to reduce this.

share|improve this answer
1  
Yeah, but if I use keychain, 1password or some other mechanism, then my passwords are stored in a 'safe' fashion (after some definition of 'safe', of course) and I just lose the usability benefit of not having to be a touch-typist. –  user185 Mar 6 '11 at 18:21
1  
People will forget their passwords even if they have to remember them. It just means passwords are written down on paper instead of encrypted somewhere. –  rox0r Aug 31 '11 at 19:40
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.