214

Today I logged in to pay my cellphone bill, and I found that the site has disabled paste functionality in password field.

I'm a webdev and I know how to fix this, but for regular user is REALLY annoying having to type a random password like o\&$t~0WE'kL.

I know that is normal to make users write the password when creating an account, but is there any reason to disable pasting passwords during login?

  • 87
    I've heard the theory that "we want to train users to keep their password off the vulnerable clipboard" ... but if that's been compromised, is the keyboard any safer? – plainclothes Jul 25 '16 at 23:04
  • 120
    why do you think it's "normal to make users write the password when creating an account"? that's exactly the same: it hinders the use of Password Managers (which for example generate good new passwords to use when creating an account) – DaniEll Jul 27 '16 at 5:27
  • 9
    @DaniEll I would think that they disable password pasting when creating an account so people don't write the wrong password in the first field, and copy the wrong password to the second field... – Dupontrocks11 Jul 27 '16 at 13:15
  • 94
    not to mention, since it does not prevent the user from copying their password from wherever, it does not make the clipboard any safer. By the time the user realize paste does not work, it is too late. – njzk2 Jul 27 '16 at 13:22
  • 36
    No not at call. Sounds like a Financial Institution's Security Expert's idea. Like hey, let's limit the length to 15, for [insert-bad-reason]. – Andrew Hoffman Jul 27 '16 at 19:24

10 Answers 10

258

There is no substantial security benefit to disallowing pasted passwords; on the contrary it is likely to weaken security by discouraging the use of password managers to generate and autofill randomized passwords. While some password managers are capable of overriding pasting restrictions, the point still stands that users should not be forced to type their password by hand.

Excerpt from a relevant WIRED article:

Websites, Please Stop Blocking Password Managers. It’s 2015

But what’s crazy is that, in 2015, some websites are intentionally disabling a feature that would allow you to use stronger passwords more easily—and many are doing so because they wrongly argue it makes you safer.

Here’s the problem: Some sites won’t let you paste passwords into login screens, forcing you, instead, to type the passwords out. This makes it impossible to use certain kinds of password managers that are one of the best lines of defense for keeping accounts locked down.

  • 16
    Another article that covers "defences" of this practice: troyhunt.com/the-cobra-effect-that-is-disabling – JakeSteam Jul 27 '16 at 8:51
  • 6
    Sounds like some good ol' Name & Shame is in order. Who the heck intentionally does that? – Andrew Hoffman Jul 27 '16 at 19:26
  • 8
    Could be worse. The .gov site for buying T-bills required the on-screen keyboard with random letter placement to mouse-type. Utter torture for a random strong password, and after doing that once I fixed it with greasemonkey. – JDługosz Jul 28 '16 at 7:59
  • 2
    @KevinKrumwiede PayPal seems to have reversed the problem, at least for me. If I try to autofill with LastPass, it tells me my password is wrong, but if I have LastPass copy my password to my clipboard and I paste it manually, it works just fine. – Mike Kellogg Jul 28 '16 at 15:53
  • 4
    I can't stand when I can't "paste" my password. As an avid password manager user I have a password for just those sites. It's not secure and it's not strong. Essentially, i might as well just use the word password. I also consider that entire site to be insecure because of that. – coteyr Jul 28 '16 at 16:44
104

Disabling pasting a password field introduces a "Cobra effect". A Cobra effect "occurs when an attempted solution to a problem actually makes the problem worse."

Troy Hunt recently wrote an article where he explains it in more detail. It's essentially a security theater, like what happens at airports to "make us safer". Troy Hunt calls it a Cobra effect because it disables the use of secure, 50-character passwords that would be pasted from a password manager. At best, it forces people to create passwords that are easy to remember and thus more hackable.

Some might say that it makes you safer because it prevents your clipboard from being copied by malware, but they ignore the fact that if malware can already do that, they can also copy all kinds of keypresses, not just Ctrl+V. It's pointless.

From a UX perspective, it's just annoying, like you say. So it's annoying from a UX perspective, and it doesn't make us safer. There's no point to this "feature".

  • 7
    While I agree with your answer in general I disagree with your opinion on clipboard safety. Flash player for instance is able to access the clipboard but I think it cannot log your key presses (at least as long as the flash object is not focused) – fishbone Jul 28 '16 at 14:55
  • 2
    If Adobe is correct, Flash player can only read the clipboard when the user actively pastes something from it. – Roland Illig Jul 31 '16 at 21:19
  • 7
    Honestly, if your excuse for not being able to paste passwords on your website is "we are concerned about malicious flash plugins stealing your credentials", then I really wonder why you allow malicious flash plugins on your website in the first place. there are 2 ways any website could have this happen: through malvertising and through site compromise, and those usually do much worse stuff than steal one (usually unique) credential for one site. – Nzall Aug 1 '16 at 13:53
  • I agree with the spirit of this answer, but it's wrong to say that it is 100% pointless. There are scenarios where clipboard compromise can occur, but keylogging (or other attacks) either can't or are less likely. Example: a locked down kiosk OS, or an opportunistic attacker who happens to witness a password paste. – Jon Bentley Aug 3 '16 at 8:45
31

No, there is no sensible reason for doing this. It is bad UX, plain and simple. Disabling pasting into a password field is actually encouraging bad passwords. Password managers automatically clear out the clipboard after pasting, so that argument is no longer valid.

  • 5
    Some password managers* I use LastPass which is a pretty big name password manager and it does not clear my clipboard – DasBeasto Jul 26 '16 at 22:01
  • 11
    @DasBeasto it does, but not after pasting, but after a specific set time of copying it. It will also clear the clipboard on exiting the application – SztupY Jul 27 '16 at 16:09
  • 1
    Even if it where true that password managers clear out clipboards after pasting not everyone uses password managers, and people will copy-paste from other sources as well. – Taemyr Jul 27 '16 at 19:38
  • What about detecting the paste in the javascript in the login form and clear the clipboard afterwards? Is javascript powerful enough? – beppe9000 Aug 1 '16 at 15:41
  • 1
    @beppe9000 Why screw with the user's clipboard at all. They are the user, presumably they know what they are doing and are the best positioned to manage their own passwords. Perhaps they have a system that does something more intelligent than what the web page does. What if they just want to see what their password manager pasted to troubleshoot a technical issue? – Sqeaky Aug 2 '16 at 15:37
24

The main security argument to disallow copy&pasting of passwords is that the password remains in the users clipboard afterwards. This can lead to accidental exposure of the password in an unrelated context. For example when the user then accidently pastes it into a different input field in a different application (web or otherwise). Another possible scenario could be when the user walks away from their device without locking it and someone else presses ctrl+v to check what they have in their clipboard.

However, this is a really small risk compared to the huge security advantages password managers have. Also, password managers often have a feature to auto-clear the clipboard a few seconds after copying a password from them which greatly reduces this risk.

  • 24
    There's also one big problem with this logic, which is that you would already have copied your password before you found out you couldn't paste it... – Ant P Jul 27 '16 at 15:51
  • 5
    @AntP But you will only make that "mistake" the first time you try to log into the website with your password manager, not every single time you use the application. – Philipp Jul 27 '16 at 15:54
  • 24
    True enough... Mostly because I wouldn't be logging in a second time :) – Ant P Jul 27 '16 at 15:56
  • 1
    Yeah, I think the really misguided motive here is assuming that this practice will "train" users to never copy their password into the clipboard, when all it will really do is force them to work around it on this particular site. – recognizer Jul 27 '16 at 15:57
  • 9
    @Philipp Only if you log in frequently enough that you remember it doesn't work. If you only log in once a month or three times a year, you're likely to forget and try again, or maybe even try again hoping they got rid of the "feature." – jpmc26 Jul 29 '16 at 0:20
12

There are reasons to do it, though not very good ones.

Basically, it discourages copy and pasting. This means users are less likely to forget it on their clipboard and have it accidentally leaked. Also if they are pasting it, it means they have it saved somewhere (like a text file), which is not as secure as their brain - so if the text file becomes useless, maybe they'll rely on their memory more.

Of course these don't actually make sense. A lot of people who copy and paste are doing so from their password manager, which is very well protected. Password managers automatically clear the clipboard as well, and as pointed out elsewhere, what are the odds that your user got a keylogger that can read the clipboard but not the key presses?

To me, things like this reveal a kind of contempt for the user's intelligence. It's basically saying, "you are too dumb to not get your password stolen, you are too dumb to follow simple security guidelines, we are just going to strap this baby harness on you to protect you from yourself". Nevermind that when your login details are stolen, it's far more likely to be because of a data breach on the server side, rather than some clipboard leak on the client side. I try to avoid such sites if at all possible, since they make me think I'm not the right audience for the site.

Luckily many password managers these days are starting to just emulate key presses instead of straight up pasting, so in the end the joke's on them.

9

I can actually think of exactly one good reason to disallow password pasting. When initially setting your password, or changing it.

The reason is that there does exist a small chance that for whatever reason, you failed to copy your password into the clipboard when you thought you had, and so what you paste into the password field is actually just whatever nonsense was on your clipboard before that. Since the password field is masked, you'd have no way of knowing that you've just pasted

826 W. Main St. into the new password field, instead of

Bubblez84-l0ve!
or
h*7dn$l83k&(4;p

like you thought you had. Which will be a real problem the next time you try to log in.

  • 7
    So what? There is password recovery. Also you likely will also paste that password tp permanent storage before/after you set it on web site and you should either notice or just have it the same anyway. – akostadinov Jul 28 '16 at 6:37
  • @akostadinov if (you thought) you copied the password from somewhere, it's unlikely you'd put forth any special effort to also paste it into a clear text space near the same time. Unless you're like me and have actually experienced the situation firsthand where you take the action that should copy something, but doesn't, and realized that that was what had happened. – Dan Henderson Jul 28 '16 at 6:55
  • 11
    A good way to get rid of this problem is to stop masking the passwords. It adds very little security in most situations. – pipe Jul 28 '16 at 9:39
  • 1
    @pipe I'm with you. It only really helps if you're in a public space and/or somebody is likely to be looking over your shoulder at all times. Having an option to reveal the password (which actually seems to be becoming a thing as of late) is completely fine. A lot of times users won't have somebody literally watching over their shoulder. And besides, if somebody was watching them, then it's not like masking helps that much. The person watching can also note what you type or will also see what you copied. They aren't as likely to remember it but...the situations aren't that likely, either. – VLAZ Jul 30 '16 at 11:41
  • @pipe it does make sense during screencasts or presentations. Unless, of course, the password owner shouts the password to the presenter just beforehand. – John Dvorak Aug 1 '16 at 6:04
1

Many of the answers point out this is bad practice because it can break password managers. While the use of password managers should be encouraged storing passwords in the clipboard should be strongly discouraged. The clipboard is not some special secure locker for information and by design makes it contents easy to access and offers no encryption.

Here is just one scenario of how this could be exploited:

  • User copies password in plain text.
  • User visits another website with a Flash application while just surfing the web. Or the website was sent to the victim intentionally by the attacker.
  • Flash allows access to the clipboard as an API. So the clipboard contents are easily accessed and can sent to the attacker.

There have even been cases where someone bought a bunch of rich media ads on a bunch of well know websites. While they looked like a seemingly harmless flash ad it was actually stealing the visitors clipboard data in hopes of getting useful information.

So in closing, if you have something you want to keep safe and secure don't store it in the clipboard.

  • 4
    ...or just copy something else into the clipboard right afterwards. – Dan Henderson Jul 28 '16 at 6:58
  • 9
    Or don’t use Flash on your login page. – JDługosz Jul 28 '16 at 8:03
  • 4
    A password manager usually clears the clipboard after a few seconds. Mine also uses a combination of typing and selective copy/pasting, as such my password is never completely readable in my clipboard or typing history (e.g. keylogger's log file) – BlueCacti Jul 28 '16 at 10:29
  • 2
    @ardaozkal The clipboard on Windows does not have a history but you're right that a program could make its own history. – MiniRagnarok Jul 28 '16 at 13:47
  • 1
    @baconface do you have a reference for flash having access to the user's clipboard with no interaction from the user? according to this adobe.com/devnet/flashplayer/articles/… it requires user interaction to get the system clipboard. – Rоry McCune Aug 5 '16 at 10:09
1

I'm a product manager for online security at a very large company.

I actually had a meeting today regarding the disabling of pasting passwords. We do allow to paste passwords at the moment but think about changing it.

There are different perspectives you can take on this approach and the pros/cons may completely vary depending on the use case you have and how your site is secured and if you use 2FA or not.

Personally i would not disable the pasting of passwords for sites that only rely on username & password for the login.

I'm thinking about disabling it in our case for several reasons

  • The strength of your password does not make you more secure in our case. Yeah, i know we are telling people since ages that they should choose a reasonably secure password but in the end this won't help you/us a bit if your computer is infected by malware. Malware doesn't care if your password is "12345" or some super complicated 100 character cypher. It either steals it or takes over your session.

  • We don't face the risk of brute-force or password-guessing attacks. There are ways to mitigate against that which are in place in our case.

  • There are behavioral biometrics solutions where profiles are built based on keystroke dynamics etc. which allow with a high degree of certainty to identify if a user that enters the credentials is indeed the user we expect. Credentials are true or false. If somebody has your credentials he is able to authenticate. This is why i would like to know if the person who is entering the correct credentials is indeed the person that we expect to know them. Username and password have to be entered every time during the login process so those fields are pretty interesting to check if such a solution is deployed at the organisation. This is not possible if somebody copy/pastes their password.

I have not made up my mind about disabling it in our case yet. As always we need to keep a balance between usability and security.

  • 10
    In my eyes, your arguments do not hold. "The strength of your password does not make you more secure in our case." - Then, why do you have passwords at all? And when I always choose strong passwords (using e.g. a pw manager), why should I make an exception for your site? – Dubu Jul 29 '16 at 13:48
  • 11
    "We don't face the risk of brute-force or password-guessing attacks." - Brute-force attacks are done with a script sending data directly to your server, not with a browser. Disabling pasting annoys your legitimate users, not hackers. – Dubu Jul 29 '16 at 13:49
  • 4
    "There are behavioral biometrics solutions where profiles are built based on keystroke dynamics etc." - What would you do if a user enters correct credentials but with "wrong dynamics"? Deny access? And using complex passwords, I am very much prone to mistype and retype them a lot. I think you would never yield the same "dynamic" from me twice. – Dubu Jul 29 '16 at 13:54
  • 3
    @Dubu I suspect that correct credentials with wrong dynamics would lead to an identity challenge, along the lines of: Biometric data is inconsistent with user "Dubu". Secondary verification required. Please [answer this security question/type the code we just texted to you/check your registered email address for a verification link]. – Dan Henderson Jul 29 '16 at 14:51
  • 9
    Point 1 - it's in favour of pasting. If it doesn't matter whether the user is protected, then disabling it still doesn't matter but tends to annoy users. Net gain - nil for security, point for usability. Point 2 - a point against whoever thinks brute forcing is done through the web page. Net gain: -1 for security. Point 3. - the biometrics are shit. It's inconsistent. Typing with one hand, the wrong hand (on mobile), different keyboard, different place can affect it and issue a challenge. Lots of false positives. Even if a user's typing is consistent, it would probably not be that unique. – VLAZ Jul 30 '16 at 11:52
1

Other answers have given more in-depth explanations, but in short remember that the biggest security risk with regards to passwords still comes from attacks targeted at the servers, not at a client. In other words, having your password on the clipboard doesn't really put it at much risk because if the password were to be cracked it would more likely be cracked from a password database stolen from the server or even bruteforced than stolen from your clipboard.

Hence why it is significant that, as other answers have pointed out, preventing a user from pasting their password discourages them from having a complex password, making their password easier to bruteforce and therefore less secure.

-3

I think it depends on the services which are secured by the login form. It is important to consider that a password manager can restrict the login to the device where the password manager is installed, which is not always what the service provider agrees with. For example, if the service was a bank which wants to give their users the opportunity to lock cards in case of loss or thievery, it may not want to restrict this privilege to cases where the device running the password manager was not also lost or stolen.

  • 6
    How could a password manager stop you logging in on another device? And your last sentence is somewhat unclear. – AakashM Jul 27 '16 at 9:26
  • 4
    As @AakashM has pointed out, I see no reason why using a password manager would prevent me from login in from a different device. I either install the pw manager on that device as well, memorize the password or type it over. – BlueCacti Jul 27 '16 at 10:45
  • 1
    Are you trying to say that a bank might not want users to use password managers because then they would be unable to log on to cancel their cards if the computer was taken in the same theft? If so, you should remove the last "not" and find a clear phrase than "restrict the login to the device". – David42 Jul 27 '16 at 15:40
  • 1
    Password managers may be used to facilitate the usage of passwords that are hard to memorize. So, making it easy to use them might at least reduce the chance of users being able to login without the password manager. – distacle Jul 31 '16 at 23:11
  • so @distacle you're suggesting some banks might want to discourage their users from using password managers, or even using hard passwords, because... if their bank card AND computer were stolen, they might not be able to log in (on somebody else's device) to report the theft. I just wanted to be sure I understood your suggestion. – Spike0xff Aug 1 '16 at 19:02

protected by Community Jul 30 '16 at 18:09

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.