Skip to main content
9 events
when toggle format what by license comment
Jan 30 at 20:25 comment added Michael come lately Send them NIST's thoughts on the subject: "Verifiers SHOULD permit claimants to use “paste” functionality when entering a memorized secret."
Jan 16 at 14:22 answer added schroeder timeline score: 5
Jan 16 at 14:17 comment added Aleks G Yeah, that's how I'm reading it...
Jan 16 at 14:12 comment added schroeder Wow, ok. Overall, this is looking like bad security design: code that is specifically called to "block password managers", a specialised 2FA app, AJAX calls per keystroke, and IP whitelisting. Some stakeholder had very strong opinions about security and wanted "the most secure possible" without regard for knock-on security risks.
Jan 16 at 14:09 comment added Aleks G @schroeder Funny enough, it does allow pasting (as in, I can do ctrl+v or right-click and paste from context menu) - and the pasted value stays in the field - but when I click "login", I get "invalid password" error. I suspect they do something with their "ajax call on every keypress".
Jan 16 at 14:09 history edited schroeder CC BY-SA 4.0
added 21 characters in body; edited title
Jan 16 at 14:05 comment added schroeder I'm guessing this will end up being your answer: security.stackexchange.com/questions/131106/…. Short answer: the devs think they are being clever and preventing one risk while actually exposing much greater risks.
Jan 16 at 14:03 comment added schroeder is it blocking the plugin or is it blocking any form of copy/pasting into the field?
Jan 16 at 13:42 history asked Aleks G CC BY-SA 4.0