2

I use a password manager and have a browser plugin installed for it to simplify entering passwords into websites. I recently encountered a website (enterprise SaaS solution I use at work), which actively blocks password managers from auto-filling passwords. The plugin isn't able to populate the password field, and if I "force" the plugin to populate it, the site immediately deletes everything entered into the password field. The only way to enter the password is to manually type it into the field. The password complexity requirements are very high (minimum 16 chars, all four character classes, cannot reuse previous 10 passwords - at least passwords don't expire).

Looking in the browser console, I can see a string printed from javascript somewhere "Starting code to block password managers". When I type a password into the field, I can see an AJAX request being sent on every keypress. The request seems to be to an API endpoint and the content is encrypted locally, so I can't see what is being sent.

2FA is required to log into the website, with the only option for the second factor is their own mobile app (installed from the itunes app store or google play).

Leaving all other details aside, why would a website actively block password managers?

P.S. The site in question is not available over public internet - our corporate IP addresses had to be whitelisted by the provider.

Improve this question
6
  • is it blocking the plugin or is it blocking any form of copy/pasting into the field?
    – schroeder ♦
    Commented Jan 16 at 14:03
  • 3
    I'm guessing this will end up being your answer: security.stackexchange.com/questions/131106/…. Short answer: the devs think they are being clever and preventing one risk while actually exposing much greater risks.
    – schroeder ♦
    Commented Jan 16 at 14:05
  • @schroeder Funny enough, it does allow pasting (as in, I can do ctrl+v or right-click and paste from context menu) - and the pasted value stays in the field - but when I click "login", I get "invalid password" error. I suspect they do something with their "ajax call on every keypress".
    – Aleks G
    Commented Jan 16 at 14:09
  • Wow, ok. Overall, this is looking like bad security design: code that is specifically called to "block password managers", a specialised 2FA app, AJAX calls per keystroke, and IP whitelisting. Some stakeholder had very strong opinions about security and wanted "the most secure possible" without regard for knock-on security risks.
    – schroeder ♦
    Commented Jan 16 at 14:12
  • Yeah, that's how I'm reading it...
    – Aleks G
    Commented Jan 16 at 14:17

1 Answer 1

Reset to default
5

The policy-based justification (which is spurious logic) is that passwords to sensitive data should never be written down, and therefore, at risk of being stolen. Passwords should be memorised and therefore safe from theft.

Therefore, password managers are bad.

Similar designs from a few years ago had the same goal, by blocking all pasting into password fields: Is there any reason to disable paste password on login?

But what happens? People write the password down, exposing an even greater risk of theft.

So, without understanding their risk assessment, this seems like "security theatre" without understanding the impact of their decisions. They want to look secure and satisfy some requirement, but missed the inherent risks of their choices.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .