Timeline for Why would website block password manager auto-fill?
Current License: CC BY-SA 4.0
9 events
when toggle format | what | by | license | comment | |
---|---|---|---|---|---|
Jan 30 at 20:25 | comment | added | Michael come lately | Send them NIST's thoughts on the subject: "Verifiers SHOULD permit claimants to use “paste” functionality when entering a memorized secret." | |
Jan 16 at 14:22 | answer | added | schroeder♦ | timeline score: 5 | |
Jan 16 at 14:17 | comment | added | Aleks G | Yeah, that's how I'm reading it... | |
Jan 16 at 14:12 | comment | added | schroeder♦ | Wow, ok. Overall, this is looking like bad security design: code that is specifically called to "block password managers", a specialised 2FA app, AJAX calls per keystroke, and IP whitelisting. Some stakeholder had very strong opinions about security and wanted "the most secure possible" without regard for knock-on security risks. | |
Jan 16 at 14:09 | comment | added | Aleks G | @schroeder Funny enough, it does allow pasting (as in, I can do ctrl+v or right-click and paste from context menu) - and the pasted value stays in the field - but when I click "login", I get "invalid password" error. I suspect they do something with their "ajax call on every keypress". | |
Jan 16 at 14:09 | history | edited | schroeder♦ | CC BY-SA 4.0 |
added 21 characters in body; edited title
|
Jan 16 at 14:05 | comment | added | schroeder♦ | I'm guessing this will end up being your answer: security.stackexchange.com/questions/131106/…. Short answer: the devs think they are being clever and preventing one risk while actually exposing much greater risks. | |
Jan 16 at 14:03 | comment | added | schroeder♦ | is it blocking the plugin or is it blocking any form of copy/pasting into the field? | |
Jan 16 at 13:42 | history | asked | Aleks G | CC BY-SA 4.0 |