It’s 2023, why are websites actively preventing pasting into fields like passwords and credit card number boxes? I use a password manager for security, it’s recommended by my employer to use one, and it even avoids human error like accidentally fat-fingering keys, and best of all with the credit card number I don’t have to memorize anything or know a single digit/character!

I have to use the Don’t Fuck With Paste addon just to be able to paste my secrets into certain monthly billing websites; why is my electric provider and one of my banks so asinine that pasting cannot be allowed? I can only imagine downsides and zero upsides to this toxic dark-pattern behavior.

There is even a mention about this in NIST SP 800-63B, a standard for identity management that some companies must follow in the USA, which mentions forcefully rotating passwords and denying “password paste-in” as antiquated/bad advice:

Verifiers SHOULD permit claimants to use “paste” functionality when entering a memorized secret. This facilitates the use of password managers, which are widely used and in many cases increase the likelihood that users will choose stronger memorized secrets

Edit: I discovered that for Firefox users there’s a simpler way than exposing your secrets to someone’s third-party addon. Simply open about:config, search for dom.event.clipboardevents.enabled, and change it from true to false.

Edit 2: As some have pointed out, that config value interferes with regular functionality on some sites. Probably best to leave it alone unless you know what you’re doing.

  • zen@lemmy.amyjnobody.com
    link
    fedilink
    English
    arrow-up
    27
    ·
    1 year ago

    Step 1: In FireFox, make a new bookmark with the location: javascript:(function(w){ var arr = ['contextmenu','copy','cut','paste','mousedown','mouseup','beforeunload','beforeprint']; for(var i = 0, x; x = arr[i]; i++){ if(w['on' + x])w['on' + x] = null; w.addEventListener(x, function(e){e.stopPropagation()}, true); }; for(var j = 0, f; f = w.frames[j]; j++){try{arguments.callee(f)}catch(e){}}})(window);

    Step 2: Drag the bookmark to your toolbar.

    Step 3: ??? ::: When a website does bullshit like not allow you to paste, not allow you to right click, etc. Click the button you made in step 2. :::

    Step 4: Profit

    It is your browser, your computer. You decide what code runs on it.

    Bonus Step: Install something like ublock origin or noscript and stop allowing websites to run any code they like willy nilly on your PC without permission. Half of that crap just tracks you for no real benefit (to you).

      • Lmaydev@programming.dev
        link
        fedilink
        English
        arrow-up
        4
        ·
        1 year ago

        It overrides the events that websites use to disable the operations (right click, copy, paste etc.) With code that stops the website’s code running.

        Essentially restoring their default functionality.

        Clicking the bookmark executes the JavaScript.