HSBC Bank plc (UK) has a OTP system to confirm online payments via SMS. The 6 figure number is sent to the user who enters it into the website. Sometimes the cards registered email address is requested at the same time. This is via a text box with a javascript listener that prevents the email address being pasted in unless the listener is removed. Removing the listener allows the email address to be pasted and the transaction completes successfully.

What advantage is the javascript listener providing to whom? Am I any less secure removing the listener rather than typing the email address by hand?

  • 2
    It's supposed to discourage users from copying passwords/emails/etc., since the clipboard can be easily read by malicious programs.
    – user
    Jun 13, 2022 at 18:53
  • your security is not affected at all by removing the event. i would whip up tampermonkey to do it automatically for me.
    – dandavis
    Jun 14, 2022 at 21:17


You must log in to answer this question.

Browse other questions tagged .