It’s 2023, why are websites actively preventing pasting into fields like passwords and credit card number boxes? I use a password manager for security, it’s recommended by my employer to use one, and it even avoids human error like accidentally fat-fingering keys, and best of all with the credit card number I don’t have to memorize anything or know a single digit/character!

I have to use the Don’t Fuck With Paste addon just to be able to paste my secrets into certain monthly billing websites; why is my electric provider and one of my banks so asinine that pasting cannot be allowed? I can only imagine downsides and zero upsides to this toxic dark-pattern behavior.

There is even a mention about this in NIST SP 800-63B, a standard for identity management that some companies must follow in the USA, which mentions forcefully rotating passwords and denying “password paste-in” as antiquated/bad advice:

Verifiers SHOULD permit claimants to use “paste” functionality when entering a memorized secret. This facilitates the use of password managers, which are widely used and in many cases increase the likelihood that users will choose stronger memorized secrets

Edit: I discovered that for Firefox users there’s a simpler way than exposing your secrets to someone’s third-party addon. Simply open about:config, search for dom.event.clipboardevents.enabled, and change it from true to false.

Edit 2: As some have pointed out, that config value interferes with regular functionality on some sites. Probably best to leave it alone unless you know what you’re doing.

  • t0fr@lemmy.ca
    link
    fedilink
    English
    arrow-up
    83
    arrow-down
    2
    ·
    1 year ago

    Agree. It is a stupid and antiquated idea. Two things I’d like to say though:

    One: you can probably set up some form of auto-type from your password manager to get around this issue.

    Two: blocking pasting is probably because password managers and operating systems must be secure when it comes to the clipboard, and clipboard management. Because if that’s not safe, your passwords you are copying and pasting are not safe.

    • deweydecibel@lemmy.world
      link
      fedilink
      English
      arrow-up
      54
      arrow-down
      2
      ·
      edit-2
      1 year ago

      Two: blocking pasting is probably because password managers and operating systems must be secure when it comes to the clipboard, and clipboard management. Because if that’s not safe, your passwords you are copying and pasting are not safe.

      Yes, but it’s not their clipboard, it’s not their browser, it’s not their operating system, why are they breaking basic functionality when my password isn’t their responsibility until I have entered it into their field and sent it to them?

      This is the nannying bullshit I can’t stand. They made their shit more difficult to use, not to protect our private information on their servers or saved in their software, but solely because they’re concerned about how I’m using the clipboard on my own device.

    • manitcor@lemmy.intai.tech
      link
      fedilink
      English
      arrow-up
      21
      arrow-down
      1
      ·
      1 year ago

      these days password managers clear the clipboard, still the clipboard is not secure which would be why some still block it.

      really its an indication we need to drop User/Pass auth once and for all.

      • Muddybulldog@mylemmy.win
        link
        fedilink
        English
        arrow-up
        26
        ·
        edit-2
        1 year ago

        Which has always been an asinine point of view. By the time a site has blocked the paste the password is already in the clipboard. No security has been added in that regard, only frustration.

      • NewNewAccount@lemmy.world
        link
        fedilink
        English
        arrow-up
        6
        ·
        1 year ago

        really its an indication we need to drop User/Pass auth once and for all.

        What’s a suitable replacement here?

        • Established_Trial@lemm.ee
          link
          fedilink
          English
          arrow-up
          5
          ·
          1 year ago

          Google, Apple, and Microsoft are working on Passkeys. I don’t know the security behind it, but so far it’s been great for the few sites that support it.

        • manitcor@lemmy.intai.tech
          link
          fedilink
          English
          arrow-up
          5
          arrow-down
          1
          ·
          edit-2
          1 year ago

          The system mentioned by Established here is called VRF, there is also technology called Self-Sovereign Identity aka DiD (a w3c standard)

          To keep it simple, essentially we are moving to authenticators using systems that are similar to how a website identifies itself and secures your connection. For the user it will still be mostly the same, unlock device, unlock data (which I bet in some cases will STILL be password during the transition) do your thing. As time goes on and things like identity keys that we carry with us become a thing (think like a fancy version of the electronic door cards).

          In general it will be much easier and less an issue to get into most systems and all of your accounts become more secure as we move away from having any data on the provider that could be used to reconstruct your password. Ofc all of this is still a bit away from being fully realized, expect rollouts to become more serious by the end of the decade.

            • manitcor@lemmy.intai.tech
              link
              fedilink
              English
              arrow-up
              4
              ·
              edit-2
              1 year ago

              this is not dissimilar to how high security setups work for organizations now, really what this is is a scaling up of the kind of things IT administrators are already doing when locking down production among other systems (its a very common login pattern for Linux based systems for thier SSH terminals).

              The big difference here is that your password changes from a password to a digital signature bound to time, hardware and the user. If the user so chooses they can always put a many levels on top of that that they want, be it passwords, additional keys, biometrics, what-have-you.

              Since your credentials never leave your device data breeches do not compromise your account or access to it (only the data the provider failed to protect). This also enables even higher levels of security through the whole credential chain, want to end-to-end-encrypt your data and encode it with your own cipher while storing it in the providers database? This is not only possible it will end up changing how we develop some applications. As a developer I just want to give you the utility, if I can ensure strong encryption that I NEVER have access to, its a whole boat of liability I don’t even have to worry about.

              In short we are taking the mechanics of auth and making it entirely cryptographic with keys without any worry about compromising a simple text input box. The possible combinations of certificate data and system parameters alone increases the difficulty of a breech through login significantly.

              It will not stop everything of course, and the usual risks around a bad release, a failed audit and an admin bypassing things knowing or unknowingly are all still problems.

              The other thing this enables, should it get that far, decentralized replacement of Google/MS/Amazon auth systems many of us MUST gate our sites with, youll be able to accept logins from multiple systems without ever having to write any new code. As the standard becomes adopted and supported firing up a site with all the usual traditional logins combined with the more-modern cert-style setup will no longer be a game of dealing with app setups and IAM, you can just load and go.

              Example of difference here: I could paste my public key to my prod systems here on lemmy and it would not change a thing about access to my systems, no one with the key or any of my signatures could do anything. With certificate based auth we know both sides of the transaction as well so MITM is not a thing in most scenarios.

              • can@sh.itjust.works
                link
                fedilink
                English
                arrow-up
                0
                ·
                1 year ago

                Thank you for the detailed reply. I just had other things in mind. For important things, sure, but I kind of appreciate the ability to give some website a username, password, and maybe an email and that’s all the ask.

                I know IPs and browser fingerprinting kind of make this moot anyway.

                • manitcor@lemmy.intai.tech
                  link
                  fedilink
                  English
                  arrow-up
                  2
                  ·
                  1 year ago

                  you won’t even give them that in this kind of system. you will get a user hash that is based of your signature, the system your using’s key and some mux of time and entropy input. This hash will be how they track you in a database and as systems evolve could even be a way to communicate with the user directly (like email) without knowing or holding any PII/NPI

                  Anything you assign to them would be data they have (maybe a common display name). Anything truly important that needs to be up there can be encrypted with different techniques that would allow the provider to work with your data without ever having to access or decrypt your data.

                  so the idea of them “needing to have something” to function is true, but fundamentally, they don’t need as much to operate in this system and its possible to have standards that enforce security on your more sensitive details that are sent. Imagine the security of your data, on thier system, still being ruled by your security. Even if hackers get in and copy the entire database its effectively useless.

        • Pika@lemmy.world
          link
          fedilink
          English
          arrow-up
          3
          ·
          1 year ago

          some sites like Walmart are removing the password requirement completly in favor of OTP, mcdonalds does the same, you type your email/phone number it sends you a link and you click the link to gain access. I wouldn’t recommend that for a bank site but, a low risk site? why not.

          • koreth@lemm.ee
            link
            fedilink
            English
            arrow-up
            15
            ·
            1 year ago

            I find that setup an obnoxious user experience. Instead of one hotkey that tells my password manager to fill out the login form, now I have to switch to my mail app, wait for the login email to arrive (if my mail provider or the site’s mail provider is having trouble, no login for me!) then back to my browser where I need to close the original tab because clicking the email link opened a new one.

            If I am on a shared computer, now I need to either manually copy a long URL from my phone or read my email on that computer, a much bigger security risk than just entering a password and 2FA code.

    • gornius@lemmy.world
      link
      fedilink
      English
      arrow-up
      5
      ·
      1 year ago

      You can just as easily have keylogger running in backround as clipboard sniffer.

      Browsers don’t have permission to read clipboard, just change them (unless you specifically give them permission to read it).

      As you can see no benefits not using PM. It’s in fact safer, because if databade with non-hashed passwords leaks, your password doesn’t because it’s different for every service.

  • iamak@infosec.pub
    link
    fedilink
    English
    arrow-up
    53
    arrow-down
    1
    ·
    1 year ago

    This is one of the dumbest shit ngl. My bank also does this. However they go one step further. They force a maximum 12 letter password and 1 character of each type (capital, small, number, symbol) is necessary. This actively reduces password security smh

    • lenathaw@lemmy.ml
      link
      fedilink
      English
      arrow-up
      13
      ·
      1 year ago

      Mine truncated the first 8 characters, when I discovered that I sent them a request to their cyber security department and they told me.of was by design.

      I closed my account over that bs

      • TheSacredOne@lemm.ee
        link
        fedilink
        English
        arrow-up
        5
        ·
        1 year ago

        It’s because they likely have an ancient backend that can’t fit it in the database field…

          • RIP_Apollo@feddit.ch
            link
            fedilink
            English
            arrow-up
            2
            arrow-down
            1
            ·
            1 year ago

            Good idea, although this wouldn’t tell you if they truncated the password at 9 characters instead (or 10 or 11 characters etc).

            So you would have to try different attempts without making too many in one sitting that gets you locked out.

            If you tried your password without the last character, then I think that would tell you if ANY truncation is being used (but it won’t tell you whether it happened at the 8th, 9th, 10th etc character). But that seems like the best thing to try first just to rule it out.

          • lenathaw@lemmy.ml
            link
            fedilink
            English
            arrow-up
            1
            ·
            1 year ago

            that’s exactly how I figured it out. then asked for some friends and family with account in the same bank to validate

          • iamak@infosec.pub
            link
            fedilink
            English
            arrow-up
            1
            ·
            1 year ago

            I checked network logs. Apparently my bank encrypts both uid and password before sending. I put 8 chars and it gave error so I’m assuming no

    • dekatron@lemmy.fmhy.ml
      link
      fedilink
      English
      arrow-up
      8
      ·
      1 year ago

      My bank also does this shit. It’s aggravating to use their website when every step along the way they put the burden of security on the user.

      Pasting is disabled on almost every text field, even for things like account numbers (which they make you type in twice) when you want to do a transfer. The only way to log in is to manually type in your username, password, and a damn captcha everytime. The 6 digit 2FA code is the icing on the cake. If you idle for a minute or two, they log you out and force you to go through the whole thing again.

      • iamak@infosec.pub
        link
        fedilink
        English
        arrow-up
        2
        ·
        1 year ago

        Banks make the worst possible UI and justify it by saying “security” xD

    • dom@lemmy.ca
      link
      fedilink
      English
      arrow-up
      5
      arrow-down
      11
      ·
      1 year ago

      Because people would write down their passwords? I wonder how many people use their browser’s built in password manager

      • chinpokomon@lemmy.ml
        link
        fedilink
        English
        arrow-up
        20
        ·
        edit-2
        1 year ago

        That’s one way it is weaker, but moreso because it reduces the entropy. If a user can provide a password which uses 26 letters, upper and lowercase, 10 numbers, and an unrestricted set of symbols, but for the sake of argument we’ll say 10, then there are a lot of possible combinations. If you are limited to only 12 possible at max, it is 46^12. Now you impose an artificial requirement that it is one of each, then it actually weakens that further by making the hacker know that there is one of each in there so it is 2626101046^8. Or roughly 910^19 vs. 1.3610^18. I personally try to use passwords which are between 16-20 characters long, or roughly 2*10^33. By restricting the total number of characters and forcing specific combinations, then the password is less cryptographically sound.

        Using this calculator, https://bitwarden.com/password-strength/, it is a difference of 3 hours vs. centuries using the bank’s mandate vs. only lowercase and 20 characters.

        Edit: Something seemed off about the math. Should have multiplied instead of added, but still less sound secure because there are imposed requirements. The biggest issue is that there is an upper limit of 12 characters.

        • dom@lemmy.ca
          link
          fedilink
          English
          arrow-up
          5
          ·
          1 year ago

          The 20 character requirement is kind of a huge component though.

          Sure. Banks should be enforcing that instead of special characters. But the vast majority of people would just choose “football” or “password” as their passwords if they weren’t required to do something more complex.

          I disagree with the argument that it’s less secure to require symbols in passwords as a blanket statement . It’s less secure to require symbols in passwords than if you are also enforcing much longer minimum passwords as well.

          • zzz@feddit.de
            link
            fedilink
            English
            arrow-up
            5
            ·
            1 year ago

            Sure. Banks should be enforcing that instead of special characters. But the vast majority of people would just choose “football” or “password” as their passwords if they weren’t required to do something more complex.

            Ironically though, something like

            IveLovedUsingFootballAsMyPassword!EverSinceThe1980s.

            as a password would be miles ahead of even the most random character combination possible, but which is only 12-20 characters long.

            And as an added bonus, the above example is practically guaranteed to have never been used before, in addition to being correct horse battery staple (that is, tremendously easy to remember).

            I hate when a website/app in this day and age imposes an absurdly low upper password character limit like 30. (cough looking at you, PayPal, when I re-set my password a few years ago it was freaking 20, not exaggerating).

            Shouldn’t password length below like 100 (or realistically, any length until it starts crashing the js behind it?) not matter anyways, since it’s all salted, peppered and hashed before further processing anyways?

            • evatronic@lemm.ee
              link
              fedilink
              English
              arrow-up
              6
              ·
              edit-2
              1 year ago

              There is no technical reason for there to be a maximum length on the user’s password.

              Watch:

              Here’s a password bitwarden generated for me:

              Bonded-Reforest-Prenatal7-Spoken-Straggler-Catcall

              Here’s the base64-encoded SHA3-512 hash for that password:

              Q2WaVLdTAg5T4xi3VB5PMI7GkAv3np9Usa2+uTMglbMcDDAdYXzUNgAzzYLoSWku/e007vkKfvSotzoriSKt4Q==

              Here’s the has for the password password:

              6adUhnNqVQr0/qhh4jeDBcSlVaBQlN7h3KL2iv6knMOlDo3m6hMepSExH01vsFShRugoL441/y5jaMGmLpCXFg==

              Notice how the thing the website should be storing in their database is exactly the same length, regardless of the input?

              For extra fun, here’s the hash for your sample password:

              GbxnrQ31PInMSu2ik2ZR5TefgXIInSJBxZ5zwcYmkRxzw07tZoxPqJbEmcbuTBpzCZzwLrqqcxz04p8ToGszRQ==

              Here’s a tool to generate your own hashes: https://www.liavaag.org/English/SHA-Generator/

              • r1veRRR@feddit.de
                link
                fedilink
                English
                arrow-up
                4
                ·
                1 year ago

                I mean, if we’re being pedantic, there’s a reasonable technical limit once the password reaches multiple MBs of data.

                But yes, there’s no good reason for the actual limits we’re seeing out in the wild.

                • zzz@feddit.de
                  link
                  fedilink
                  English
                  arrow-up
                  1
                  ·
                  1 year ago

                  I mean, if we’re being pedantic, there’s a reasonable technical limit once the password reaches multiple MBs of data.

                  But yes, there’s no good reason for the actual limits we’re seeing out in the wild.

                  Yes @evatronic, this is of course what I meant with “except if the js starts crashing maybe”. I’m aware that hashes end up with the same length, no worries 😄

  • SolidGrue@lemmy.world
    link
    fedilink
    English
    arrow-up
    43
    arrow-down
    2
    ·
    1 year ago

    Clipboards (the buffer where copypasta is stored) are a weak link in security because ANY app can expect access to it. If there is malware on your system it generally has access to the clipboard buffer, and therefore any credentials you might paste.

    “OK, but usually you only paste the password and type the username?”

    Quite true. Keyloggers are also a thing and easy to install on desktop OS, maybe harder on mobile.OS.since (at least on android) you need to grant permissions for keyboard apps. Either way if a keylogger is installed then you’re fucked.

    It boils down to a bad risk assessment. Those services decided memorized credentials must be manually typed to prevent clipboard snooping at the (likely) cost of reduced password entropy and/or weak MFA (e.g., SMS or email based TOTP). In other words: stupid CISOs.

  • dan@upvote.au
    link
    fedilink
    English
    arrow-up
    27
    ·
    1 year ago

    Edit: I discovered that for Firefox users there’s a simpler way than exposing your secrets to someone’s third-party addon. Simply open about:config, search for dom.event.clipboardevents.enabled, and change it from true to false

    Note that this disables all DOM/JavaScript clipboard events, so sites that need custom clipboard handling (like Google Docs) won’t work properly if you try to copy and paste.

    What you can instead do is:

    1. Right-click the password field
    2. Click on the “console” tab in the browser dev tools
    3. Type $0.value = 'password' and press enter, with the correct password of course.
    • Flyswat@lemmy.ml
      link
      fedilink
      English
      arrow-up
      5
      arrow-down
      2
      ·
      1 year ago

      But then you’ll have to display your password in plaintext (could be a problem around other people) and leave a trace in the console.

      • dan@upvote.au
        link
        fedilink
        English
        arrow-up
        3
        ·
        1 year ago

        That’s true. You could instead try to unattach the paste event handler, but that’s more effort and isn’t a one-liner. There’s probably a browser extension for it.

        I usually don’t have other people behind me when using my computer, but most of my passwords are 30+ characters and randomly generated, so I’m not too worried about someone seeing it for the short period it takes me to paste it into the console the run clear() to clear the console.

  • foo@withachanceof.com
    link
    fedilink
    English
    arrow-up
    26
    arrow-down
    1
    ·
    1 year ago

    Same reason some websites still have max password lengths of 12 characters: Bad programmers that don’t know what they’re doing when it comes to the most basic of security concepts.

    • deegeese@sopuli.xyz
      link
      fedilink
      English
      arrow-up
      25
      ·
      1 year ago

      Bullshit requirements like that come from product managers.

      Programmers would rather be lazy and not have to implement a limit anyway

      • foo@withachanceof.com
        link
        fedilink
        English
        arrow-up
        1
        ·
        1 year ago

        It goes both ways: Programmers have a responsibility to inform PMs how bad of an idea short max password lengths are. And if they’re still absolutely forced to implement it anyway, do you really want to be working somewhere that goes out of their way to purposefully implement poor security and somewhere that doesn’t respect serious concerns raised from their engineers?

    • Pechente@feddit.de
      link
      fedilink
      English
      arrow-up
      8
      ·
      1 year ago

      This one always surprises me. Who the fuck is not hashing passwords? What else is wrong with this site if such basic concepts are ignored?

      • Pika@lemmy.world
        link
        fedilink
        English
        arrow-up
        6
        ·
        1 year ago

        or sometime they do hash the password but they are just ignorant of how it works so they keep the limit regardless

      • argv_minus_one@beehaw.org
        link
        fedilink
        English
        arrow-up
        4
        ·
        edit-2
        1 year ago

        If you use a proper password hash function, and some joker submits a million-character password, you’ve got a denial-of-service attack.

        The limit doesn’t have to be 12 characters, but there does need to be a limit.

        • PlexSheep@feddit.de
          link
          fedilink
          English
          arrow-up
          0
          ·
          1 year ago

          Why would that be a DOS? The hash of something is always the same length. Might only take a bit more time to compute, but a million characters isn’t that much with modern hardware. If anything, the risk of collisions would be higher.

          • foo@withachanceof.com
            link
            fedilink
            English
            arrow-up
            2
            ·
            1 year ago

            Hashing is typically done server-side. So you need to transmit the password to the server and you can’t have a truly unlimited data limit. Pretty much every web server will reject requests over some size so while it’s entirely reasonable to support something like a 1,000 char password if you really wanted to, having it be truly unlimited with something using a 10 million character password is a security/operational risk in itself.

      • Caaaaarrrrlll@lemmy.mlOP
        link
        fedilink
        English
        arrow-up
        4
        ·
        1 year ago

        There’s a website that an apartment I stayed at used for registering vehicle license plates. They have a towing company come around at night and tow anyone not registered on the website. The website emails me my password in plaintext when I go to reset it. I’ve complained to the apartment manager and the website’s contact points, but gotten nowhere, they still have this behavior today. It’s ridiculously stupid and ignorant.

  • Transient Punk@sh.itjust.works
    link
    fedilink
    English
    arrow-up
    22
    ·
    1 year ago

    Just adding that financial institutions are very hesitant to adopt new technology, and therefore tend to abide by what tech enthusiasts would consider antiquated best practices.

    Source: Software engineer in Fintech

    • scytale@lemmy.world
      link
      fedilink
      English
      arrow-up
      8
      ·
      1 year ago

      Yup, that behavior is notorious with financial institutions. Using old and archaic programming languages and systems that they are too afraid to touch because they don’t know how to rebuild it if it crashes. What I do is use passphrases for cases like that, so I can easily type them myself as a last resort.

    • ShakeThatYam@lemmy.world
      link
      fedilink
      English
      arrow-up
      6
      ·
      1 year ago

      Only, last month Treasury Diirect finally removed the virtual keyboard as the only means of password entry 🙃

      I don’t believe their passwords are case sensitive yet.

    • bluGill@kbin.social
      link
      fedilink
      arrow-up
      6
      ·
      1 year ago

      Sure, but the NIST documents referenced in the post are admissible in court. With some creative thinking you can probably help a criminal break your weak password and then put the liability on them because if their webform was correct yoy would have pasted a strong password from your manager.

    • Saneless@lemmy.world
      link
      fedilink
      English
      arrow-up
      1
      ·
      1 year ago

      Well, because it works “well enough” right now. Changing it is a monumental effort because they’re such slow ass big stupid companies anymore.

      And when they fuck it up, and they will, no one wants to be the reason for it so it never happens

      • Flemmy@lemmy.world
        link
        fedilink
        English
        arrow-up
        3
        ·
        1 year ago

        That ship has sailed… So many sites don’t actually change pages, they just load different data - it’s way faster and looks better

        Problem is, the back button takes you off the site no matter where you are, so now you can change the URL and change the history through code to have the best of both worlds

        Then, there’s the people who do it badly, and there’s the people who think “hey, if you need pro StarCraft level clicking speed to back out of my site, maybe for some reason that will make them decide to stay”

        • interdimensionalmeme@lemmy.ml
          link
          fedilink
          English
          arrow-up
          1
          ·
          1 year ago

          I’m specifically thinking of AliExpress, which erases your history when going from item page to buy page. They’re otherwise just regular pages

  • HubertManne@kbin.social
    link
    fedilink
    arrow-up
    15
    ·
    1 year ago

    Thank you. Its wonderful to see someone else feesl this way. I feel there are less than there used to be like 5 or 10 years ago but man it urks me. I was really excited by the add on but honestly im not sure I want to give it that permission which stinks. Would love to disable that behavior. Its so stupid to force you to make an easy password.

  • zen@lemmy.amyjnobody.com
    link
    fedilink
    English
    arrow-up
    15
    ·
    1 year ago

    Step 1: In FireFox, make a new bookmark with the location: javascript:(function(w){ var arr = ['contextmenu','copy','cut','paste','mousedown','mouseup','beforeunload','beforeprint']; for(var i = 0, x; x = arr[i]; i++){ if(w['on' + x])w['on' + x] = null; w.addEventListener(x, function(e){e.stopPropagation()}, true); }; for(var j = 0, f; f = w.frames[j]; j++){try{arguments.callee(f)}catch(e){}}})(window);

    Step 2: Drag the bookmark to your toolbar.

    Step 3: ??? ::: When a website does bullshit like not allow you to paste, not allow you to right click, etc. Click the button you made in step 2. :::

    Step 4: Profit

    It is your browser, your computer. You decide what code runs on it.

    Bonus Step: Install something like ublock origin or noscript and stop allowing websites to run any code they like willy nilly on your PC without permission. Half of that crap just tracks you for no real benefit (to you).

      • Lmaydev@programming.dev
        link
        fedilink
        English
        arrow-up
        1
        ·
        1 year ago

        It overrides the events that websites use to disable the operations (right click, copy, paste etc.) With code that stops the website’s code running.

        Essentially restoring their default functionality.

        Clicking the bookmark executes the JavaScript.

  • protput@lemmy.world
    link
    fedilink
    English
    arrow-up
    15
    ·
    1 year ago

    I have a hotkey that types my clipboard instead of pasting it. Just for this problem.

        • erogenouswarzone@lemmy.ml
          link
          fedilink
          English
          arrow-up
          1
          arrow-down
          1
          ·
          1 year ago

          So the best thing to do is to not store your password in plain text, and there are many discussions on the best way to do that on the AHK forums, so I won’t go into it,

          But I will say the way I have found that is best for separation of passwords from AHK is to use windows environment variables.

          So go into env variables and make a new one called something like “googlepw” and it’s value should be your Google password.

          Then in the script you can just call them as if they’re defined in the script:

          #g:: Send text %googlepw%

          (I’m on mobile, so you may have to monkey around with quotes to get that to work)

          • taladar@sh.itjust.works
            link
            fedilink
            English
            arrow-up
            2
            ·
            1 year ago

            That will include your password into any debug report of any application that includes the environment in the debug report (most) and in general all applications will have access to it.

  • baatliwala@lemmy.world
    link
    fedilink
    English
    arrow-up
    16
    arrow-down
    2
    ·
    1 year ago

    Edit: I discovered that for Firefox users there’s a simpler way than exposing your secrets to someone’s third-party addon. Simply open about:config, search for dom.event.clipboardevents.enabled, and change it from true to false.

    Do NOT do this unless you absolutely know what you are doing and it will break legitimate uses of clipboard on websites. Use it one time and revert immediately.

      • damnYouSun@sh.itjust.works
        link
        fedilink
        English
        arrow-up
        2
        ·
        1 year ago

        It prevents any website being able to run intercepts on pasting. This is good when they’re using it to just prevent you from doing it for no real reason but there are many situations where you don’t want a user to be able to arbitrarily just drop text into a text field.

        The big one is 2fa. A lot of the time you might need to enter a five digit code and each number may need to be entered into a particular box if you just click in the first box and press paste after copying the code from an email then it’ll paste the entire contents into that one box. You don’t want that you want some code to automatically paste each letter into each subsequent box, that requires you intercept the original paste command.

      • baatliwala@lemmy.world
        link
        fedilink
        English
        arrow-up
        1
        ·
        1 year ago

        One big use is the ability to copy and paste images, like imgur or (my use case) Whatsapp Web. I’ve heard Google Docs acts poorly as well.

  • Affine Connection@lemmy.world
    link
    fedilink
    English
    arrow-up
    13
    ·
    edit-2
    1 year ago

    Simply open about:config, search for dom.event.clipboardevents.enabled, and change it from true to false.

    Indeed, the upsides to this outweighs the downsides. I can’t even remember the last time I needed to re-enable it.

  • wrongturn@lemmy.world
    link
    fedilink
    English
    arrow-up
    11
    ·
    1 year ago

    Ctrl+shift+L for bitwarden and I’m set. It could be bit of a pain to shift all your passwords from all sources into bitwarden but it pays back well. Same on mobile too. Indispensable tool for me

    • variants@possumpat.io
      link
      fedilink
      English
      arrow-up
      3
      ·
      1 year ago

      Ive really only noticed this issue when filling out bank account or routing numbers, where it will let you paste in the account number in one field but not in the verify field which is so annoying

      but yeah Ctrl+shift+L is the best

    • dditty@lemmy.world
      link
      fedilink
      English
      arrow-up
      2
      ·
      edit-2
      1 year ago

      Everyone tangentially related to cybersecurity knows by now that frequent password expirations encourage users to set insecure passwords for a net negative to security, so why the hell do cybersecurity insurance providers still require expirations? We have this for my org even though we have SSO backed up with MFA for all accounts. So frustrating!

    • Hudell@lemmy.ml
      link
      fedilink
      English
      arrow-up
      0
      ·
      1 year ago

      On a similar note, copying the password to the clipboard is the weakest link in the usage of password managers today. Everything that is running on your system has access to your clipboard content and even get notified when you copy something to it.

      Your tool of choice should have an option to generate easy to read/write passphrases and you should prefer those whenever possible (without weakening the password itself), so that you can avoid moving your passwords to the clipboard whenever possible.

      • 0x01@lemmy.ml
        link
        fedilink
        English
        arrow-up
        2
        ·
        1 year ago

        Yes however, they also have access to your keyboard in realtime with getAsyncKeyState or event hooks in windows at least, so I’m not sure that’s a strong argument.

      • pazukaza@lemmy.ml
        link
        fedilink
        English
        arrow-up
        1
        arrow-down
        1
        ·
        1 year ago

        This is exactly what I was going to say. Copying and pasting passwords is definetely a no-no for me.