It’s 2023, why are websites actively preventing pasting into fields like passwords and credit card number boxes? I use a password manager for security, it’s recommended by my employer to use one, and it even avoids human error like accidentally fat-fingering keys, and best of all with the credit card number I don’t have to memorize anything or know a single digit/character!

I have to use the Don’t Fuck With Paste addon just to be able to paste my secrets into certain monthly billing websites; why is my electric provider and one of my banks so asinine that pasting cannot be allowed? I can only imagine downsides and zero upsides to this toxic dark-pattern behavior.

There is even a mention about this in NIST SP 800-63B, a standard for identity management that some companies must follow in the USA, which mentions forcefully rotating passwords and denying “password paste-in” as antiquated/bad advice:

Verifiers SHOULD permit claimants to use “paste” functionality when entering a memorized secret. This facilitates the use of password managers, which are widely used and in many cases increase the likelihood that users will choose stronger memorized secrets

Edit: I discovered that for Firefox users there’s a simpler way than exposing your secrets to someone’s third-party addon. Simply open about:config, search for dom.event.clipboardevents.enabled, and change it from true to false.

Edit 2: As some have pointed out, that config value interferes with regular functionality on some sites. Probably best to leave it alone unless you know what you’re doing.

  • r1veRRR@feddit.de
    link
    fedilink
    English
    arrow-up
    9
    ·
    1 year ago

    I mean, if we’re being pedantic, there’s a reasonable technical limit once the password reaches multiple MBs of data.

    But yes, there’s no good reason for the actual limits we’re seeing out in the wild.

    • zzz@feddit.de
      link
      fedilink
      English
      arrow-up
      2
      ·
      1 year ago

      I mean, if we’re being pedantic, there’s a reasonable technical limit once the password reaches multiple MBs of data.

      But yes, there’s no good reason for the actual limits we’re seeing out in the wild.

      Yes @evatronic, this is of course what I meant with “except if the js starts crashing maybe”. I’m aware that hashes end up with the same length, no worries 😄