Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I use a few websites that prevent me from copying & pasting into the username or password fields. It's quite frustrating when using a password manager, and if anything I'd think it discourages users from good password-management because they're going to have to choose something they can type manually over and over again.

Are there actually any benefits to preventing the paste operation on an application or website?

share|improve this question
1  
Can you characterize the sites, or name them? Are they trying to protect something of real exchange value, or are they just idiosyncratic? –  nealmcb Mar 6 '11 at 3:46
1  
The registration page for the BlackBerry Beta Zone does this: blackberry.com/beta –  Luke Girvin Jul 26 '11 at 10:00

4 Answers 4

up vote 15 down vote accepted

In my opinion, I don't think it's a net win. Those restrictions always frustrate me.

(I'm hoping someone here will post details about how to defuse or work around them. Maybe a tweak to Firefox's user_prefs.js? An extension?)

Presumably the reason why sites disable the password manager is because they're worried that Alice might sit down in front of Bob's browser and log into the web site as Bob, maybe purchasing something on Bob's tab. This is particularly an issue for roommates, family members, etc. who live together with each other. (See also "friendly fraud".) A related risk is that Bob might actually purchase something, but then claim that Alice did it to get out of paying for it. Presumably, the sites hope that by disabling the password manager, Bob will be forced to type in his password anew every time; Alice won't know the password and won't be able to type it in.

However, these restrictions come at a significant cost. They make the website less usable and more annoying for users. They also drive users to either select poor passwords (which may be more susceptible to password-guessing attacks) or to write down their passwords (potentially enabling roommates and family members to learn the password, leaving everyone back where we started). For users who do trust everyone else who has physical access to their computer, these restrictions strictly decrease security.

Personally, I suspect most sites should be reluctant to employ such measures. Odds are that you will annoy your users more than you will help them. But you will be in a better position to make an informed decision.

If you do decide to employ such restrictions, you might consider providing users a way to opt out if they do not share their computer with others. Perhaps this may only be of interest to power users, so I don't know if it's worth your time, but you could consider it.

share|improve this answer

I personally don't think there are any real benefits. I'm agreeing with the idea that you'll probably just annoy your users into picking something that isn't helpful.

That said, I believe the rationals used are either to avoid the password being saved somewhere where it might be stolen, or because they believe passwords must be typed by the user for irrational reasons. While it might be rational that it could defend against Little Johnny emptying his mother's bank account, I don't see much else in practicality. I figure if you can snag the password file, you can probably snag the keyboard input.

share|improve this answer

The two core reasons always indicated to me are:

  1. Allowing copy and paste means people will have their passwords saved in a text file somewhere, which is unsafe (yes, I know with applications like PassSafe this is a bit outdated, as the place to save passwords is 'safe')
  2. People wll forget their passwords if they don't have to remember them.

Number 2 is the most important one, I think - it's hard enough persuading people to remember their passwords when they get back off holiday - the helpdesk load is high after any major holiday, and companies try to reduce this.

share|improve this answer
1  
Yeah, but if I use keychain, 1password or some other mechanism, then my passwords are stored in a 'safe' fashion (after some definition of 'safe', of course) and I just lose the usability benefit of not having to be a touch-typist. –  user185 Mar 6 '11 at 18:21
1  
People will forget their passwords even if they have to remember them. It just means passwords are written down on paper instead of encrypted somewhere. –  rox0r Aug 31 '11 at 19:40

One example of this behaviour is Paypal - they prevent pasting in the password boxes when changing your password (but not when entering your password to log in, work that one out!!). Their rationale is:

The feature of using control-V is not available in resetting the password as this is one of our ways to insure (sic) that it is indeed the account holder who is accessing the account.

In this example, and in others I have come across, you can disable javascript in order to enable pasting. Chrome, for example, allows you to do this on a site-by-site basis, so you can just prevent Paypal from using javascript, and put up with the reduced functionality.

Anyway, frankly I don't buy their rationale. A tech-savvy user (or hacker) can disable javascript in order to bypass this feature, so all it does is force novice users to use weak passwords (i.e. those they can be bothered to type). I reported this to them, but was predictably fobbed off - for some reason customer service people never appreciate talking about tech / security issues...

Apologies for posting this as an answer rather than a comment - my reputation is not high enough yet.

share|improve this answer
    
I can copy to PayPals login textboxes. Without disabeling JS or anything... –  Tokk Feb 3 at 12:36
    
@Tokk - my mistake, I thought I'd written that it only happens when changing your password. Updated the answer! –  IBam Feb 3 at 14:08
    
Actually the whole notion that passwords must always be remembered and never written down or recorded was utter foolishness from the start. I much rather prefer that users generate longer, better, and different passphrases per important site that they use only weekly or less often, and either use a password manager, or even write them down on paper, and lock that paper in a home safe or even a locking desk drawer. The mandate that all passwords (regardless of use and value) must only be remembered has no place in the realities of today's cyber-world. –  cybermike Apr 3 at 15:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.