Hot answers tagged

122

The answers you received on the UX stackexchange are pretty much on point. There is no substantial security benefit to disallowing pasted passwords; on the contrary it is likely to weaken security by discouraging the use of password managers to generate and autofill randomized passwords. While some password managers are capable of overriding pasting ...


12

The main security argument to disallow copy&pasting of passwords is that the password remains in the users clipboard afterwards. This can lead to accidental exposure of the password in an unrelated context. For example when the user then accidently pastes it into a different input field in a different application (web or otherwise). Another possible ...


4

Using a good password manager that generates unique, long, random passwords is a good idea. The passwords are not "stored in strings or encoded". They are encrypted, hopefully with a strong encryption algorithm like AES. The encryption key is usually generated from the master password with an algorithm such as PBKDF2, specifically designed to be slow so as ...


4

There are reasons to do it, though not very good ones. Basically, it discourages copy and pasting. This means users are less likely to forget it on their clipboard and have it accidentally leaked. Also if they are pasting it, it means they have it saved somewhere (like a text file), which is not as secure as their brain - so if the text file becomes useless,...


3

I can actually think of exactly one good reason to disallow password pasting. When initially setting your password, or changing it. The reason is that there does exist a small chance that for whatever reason, you failed to copy your password into the clipboard when you thought you had, and so what you paste into the password field is actually just whatever ...


3

These measures will greatly reduce the impacts, and or attempts to circumvent them. The issue with passwords are, no matter how much you try to educate anyone, it rarely works. Individuals prefer comfort over security, as indicative by making a password: "P@ssw0rd1" to meet complexity requirements. As long as there are passwords, people will keep creating ...


3

If an attacker is aware that an OSK may be used (and that becomes more and more common with touch devices), he can prepare an OSK attack, e.g.: capture screenshots of the OSK and identify keys pressed (e.g. because they have a different color) an his own OSK on top of the existing OSK (similar to clickjacking) add a kernel mode driver to do whatever, e.g. ...


3

My guess would be that for google it allows them to handle all their various different options for TFA(two factor authentication) more easily. Off the top of my head they support 3 or 4 different methods at least. They also allow you to have multiple TFAs enabled at once so you can pick which one to use. Not saying you couldn't also handle all that on the ...


3

Forcing the user to pick a password you generated is an efficient way to prevent password reuse. That means both (a) that your passwords will not be usable on an other site if an attacker steals them, and (b) your users accounts will not be breached even if they were all on LinkedIn, MySpace, Sony and Ashley Madison. On the other hand, it will wake them way ...


2

Yes, it is most often just a useless "security measure". We need to define the threat model and then if an on screen keyboard provides a proper mitigation. A OSK will protect against two threats: A hardware keylogger A software keylogger that is only looking at the keyboard state (does not attempt to defeat a OSK). One should note the the difference ...


2

Encryption in the user space usually works by storing the key in an encrypted keychain (keychain in OSX, Gnome Keyring, KDE wallet, whatever name Microsoft uses in Windows...). This keychain is either locked by a custom password or more traditionally by your user password, so whenever you log in, your system automatically unlock it. This is pretty much ...


1

I'd say that it doesn't add much. Base64 is just an encoding, it doesn't add any entropy to your password. It's also quick to compute so it won't slow down a brute-force attack. The only thing it can prevent is an attack against an universal rainbow table that didn't take into account the base64, but maybe some rainbow table out there did take this into ...


1

I'm a product manager for online security at a very large company. I actually had a meeting today regarding the disabling of pasting passwords. We do allow to paste passwords at the moment but think about changing it. There are different perspectives you can take on this approach and the pros/cons may completely vary depending on the use case you have ...


1

@Anders answered your point on encryption, a note on Normal passwords are hashed so this isn't a problem. You can hash a password when you do not need to use it to authenticate further, but only to check if a password currently presented to you is the same as the one which was hashed. In other words, if you need the plaintext version of a password (...


1

Several different factors might influence LastPass state: Automatic logging out is a feature of LastPass that is intended to protect user passwords. The idea being that a computer left without attention for a long time might indicate it was compromised. As LastPass has no other way of telling who is using the computer, it checks asking for password (which ...



Only top voted, non community-wiki answers of a minimum length are eligible