It does allow you to paste into the login fields, but you cannot submit your login credentials this way because the "Sign On" button is greyed out until you've actually typed in each field. I let my password manager fill the fields, then I manually delete and re-type the last character from each of the 3 fields.

Also, many sites should have an easy email based login.

> Justification 2: 'Pasting passwords makes them easier to forget, because you have fewer chances to practise them'.

Difficult to remember and easy to forget passwords will be auto generated. In fact I encountered few websites that didn't accept long passwords.

> Justification 3: 'Passwords would hang around in the clipboard'

Only for 12 seconds after which keepass will clear the clipboard.

The more common place I've seen it is email address confirmation (or PW confirmation), which while probably unnecessary, is not the worst thing in the world. You are retyping an address that's displayed in the field above. Less intrusive than a captcha.

Password managers could wipe the clipboard, if it still contains the password, after a defined amount of time, such as 60 seconds.

(If you think that's "confusing", show a notification that explains the behavior; "clipboard wiped" or something.)

Password managers are a thing. Please don't force me to type out 32 random symbols twice while I sign up for your service.

The QQ messenger blocks pasting passwords on iOS I suspect for this reason, perhaps there are teams of people guessing passwords and manually typing them in like gold farming.

From what I gather this should use IPC between applications, rather than the clipboard itself.

Another annoyance is having to enter 2nd,4th,7th etc letter of the password using a dropdown. ARrrgh.

If the problem is the risk posed by password vaults and clipboard managers, promote better vaults and better utilities. Personally, I'd love a password vault that could check which application or website I'm pasting to, blocking transmission if it looks wrong. But it's not the website's job to tell me how to manage my secrets.

My largest issue is that its extremely possible to fat-finger your UN to be Hellow, and its extremely easy to see and fix that mistake.

However since passwords are hidden its hard to see ######## is actually Worls123. Now your new account has essentially a one-time login because you have no idea what your password is. Typing it out again, ensures you catch your mistake

You might want to allow paste, too, but it's the clumsy solution.

But we don't disagree, folks should definitely implement things like OpenID.

I once spend several weeks having meetings where people tried to develop a login management process on a whiteboard from first-principles — in the federal government where the right answer was “We'll follow the central security group's required process” – because they didn't have a security consultant but knew security was a Really Big Deal and didn't want anyone to think they weren't thinking about it.

All of that meant that someone launching a service couldn't assume that their users’ software supported encryption at all or securely for years. Coupled with the previously mentioned horrible user experience and cost of certificates, that really killed the idea since the password experience was both easier and far more familiar.

1. https://en.wikipedia.org/wiki/Export_of_cryptography_from_th...

I disagree with this. If you paste a password into both fields, then paste it into your password manager, it doesn't matter if you've copied the wrong thing, because your password manager will still remember it.

There was once a time where this was a workable excuse, but today's browsers are actually pretty good about following standards. If you're doing something that works in some browser, but not all, then you're likely exploiting some weird quirk of that browser.

And of course, not testing if it works in x browser is different than actively stopping your webapp from running if it doesn't detect the right browser/os combination.

I don't know what your product is, but I use four different browsers on a daily basis across three operating systems (it would have been six across 2 if not for the win10 privacy debacle, and even more if I had an android), and I want all my SAAS to work on all of them.

Experience says when they don't work everywhere, IT just dumps the service for another SAAS provider and everyone cheers.

In the token case, I wonder whether they should have been password fields to begin with. Replacing a 6-digit OTP with asterisks is of questionable benefit, because the shoulder-surfer it thwarts can't reuse the OTP and is really unlikely to swipe it and use it before you do.

That seems like it's asked with the expectation that the obvious answer is "no", but I believe it's "yes". Well, I have no idea of the quality of their devs, but someone in the decision chain thought that auto-playing videos was a good idea, and he, she, or they were wrong.

You are forked if your machine is ever rooted too. Security isn't about perfection, it's about economics and threat models. For the average person the biggest fundamental risk comes from one of the vast numbers of services they use, none of which they have the slightest control over or knowledge of, getting breached, bought, leaked or whatever. As long as we need to use passwords (long past any technical reason for it, but legacy and inertia tends to make change extremely had) for authentication, it will in turn remain necessary for people to use passwords for every site that are good (random of sufficient length), unique, and can be changed at any given arbitrary time (in case of service compromise). It is simply not possible for most humans to handle all that in their heads, perfectly and indefinitely. Which in turn leads directly to password managers, end of story. It's not a matter of them being ideal or even desirable, they're necessary under current common authentication practices.

>It's only a matter of time until a major breach happens with a popular password manager.

Explain what you mean by this? Most password managers operate purely client side, and all actual password managers perform encryption client-side, there is nothing to "breach" to get general access to a wide swath. A persistent targeted threat is an entirely different scenario. Or did you mean you expect the password manager application software deployment system itself to get breached and thus release a malware infected update? That though isn't an issue limited to password managers at all, it's one that you can at least somewhat counteract yourself since it's ultimately on a system under your control (and there are OSS password managers, etc), and password manager devs have better domain knowledge and specialization then some random service.

In terms of threat model it's a no brainer. It's disappointing to see continued protestations against password manager usage on HN of all places, short of some theoretical discussion of switching everything to proper public key auth. Even a full court industry push starting tomorrow though wouldn't eliminate passwords for likely years if not decades, and in the mean time everyone has to make the best of it.

We don't optimize for impressions per session. Instead we optimize for the number of things a user does in a fixed amount of time, (or per session). The former is a poor proxy for the latter, and you can increase impressions by adding useless click through pages that ultimately drive away users and destroy your business in the long term. (In the short term, these things make your metrics look good.)

I bring this up because slideshows are a great way to artificially boost impressions.

- copy/paste hijacking

- sensor access: microphone, camera, GPS, etc.

Maybe even go further and introduce some sort of rate-limiting for

- XHR requests

- relayout events

to save power and data.

Or people will use 2-4 character passwords (often the initials of their name etc)

Now I use a hardware token (yubikey) to store my PGP key so I can use a relatively weak PIN code on it (since you need to have physical access to the device to use it and you only have 3 attempts before it locks up). It's a pretty good quality of life improvement.

    Diceware, 6 words          77 bits
    Diceware, 5 words          64 bits
    Diceware, 4 words          51 bits
    a-zA-Z0-9, symbols, 10     65 bits
    a-zA-Z0-9, 10char          59 bits
    a-zA-Z0-9, 8char           50 bits

It's highly amusing when a site tells me that such a password is insufficiently complex, given that it will never in the lifetime of the universe be guessed.

The entropy calculations are probably generous. The wordlist isn't as long as it looks, because some of the words are strange and people tend to re-roll if they get something like that. It's probably better to assume there's only 1000-2000 "words" people will safely combine.

I'm trying to understand the reasoning for this. Are you dealing with very sensitive information that you have a real reason to fear the rubber-hose cryptanalysis method?

Just because your passphrase may essentially be a PIN look up into a lookup table doesn't mean the attacker knows that or has access to the same lookup table.

You can also add additional entropy via punctuation or casing.

The point to a random passphrase is to try to avoid "human" mistakes like over favoring a subset of words, and rerolling words you don't like potentially makes your collection of passphrases more susceptible to analysis or social engineering (word association) attacks.

Like I said, it's generally better to pick a word-list you are comfortable with all the possible words than to subset a word-list you aren't entirely comfortable with.

The goal of something like Diceware is to be easy for humans to memorize but also still true random (see: xkcd's battery horse comic). If you don't need to memorize it, then yes, why not entirely generate a random sequence of letters/numbers/symbols/emoji.

Banks figured the cost of reimbursing people if their account is compromised is lower than the cost of having to field all of those phone calls.

Source: Used to work at a bank.

I believe I read that Facebook stores a few commonly mistyped versions of everyone's password. Actual password, typed as if caps lock was on, things like that.

But why even know your own passwords, what is the point? If I can double click from my manager and paste it into my password field and never have to worry about knowing anything, I'm much happier and safer.

The 'correct casing' is any member of the set of all permutations of cases. So you both do, don't, and do not care.

- If it's a website I couldn't care about, I use a simple password, probably a remnant from growing up.

- If it's a website I'm concerned about but knowingly won't use, I create a random password and clipboard it during initial creation/login, then every time I use the website I reset it (lazy man's password generator)

- If it's a website that I care about, like HN, I have a loose pattern that I follow that includes symbols and numbers (that's the 30ish character I was referencing). Every website is unique.

- Financial accounts have their own set of rules (unless it's stupid and has, say, an 8 character limit)

- My main email accounts get special treatment with an exceptionally long password.

- Use two-factor authentication wherever possible.

And yes, I could replace this with:

- Password manager

- Two-factor authentication

E: grammar.

For instance, if I needed a new strong password, I could use, "This#jar#once#held#1111#M&Ms,#but#now#it#is#empty."

The only thing I need to remember there is the story of the jar and the padding character I used in place of spaces. If I really had to, I could put "#" on a sticky note under the jar. But of course, I can't use that password now. So I might instead use "I(used(this(jar(as(an(example(on(HN." But now I can't use that one, either. So maybe I use "These!blinds!are!very!dusty.!!Someone!should!clean!them." or "My^dog^once^killed^a^dozen^baby^rabbits^in^the^tall^grass^I^didn't^want^to^mow." or "MyFgreatFauntsFhadFreallyFlongFhair."

I get really irritated when sites tell me I have to include numbers, uppercase, lowercase, and symbols in the same password. I get especially irritated when they put an upper limit on the number of characters, or ban certain characters from appearing in the password.

(Obvious caveat being that any provider can trivially append @provid.er if you don't specify, so this isn't really proof that email is specified that way.)

And if you try to actually use a bare TLD you will crash hard into collisions with unqualifed domains and search paths. So, fun as a hack to amuse fellow techies but not useful for anything real.

Use a password manager. KeepassX is free, cross-platform, works on phones, does all that work for you, secures even your least-valuable accounts, does things right, doesn't store your passwords "in the cloud" and you'll get to keep applying your scheme to your master password.

While I believe the + was common for postfix, exim and sendmail?

There even was a spam-fighting scheme that used this - it took a key, and optional date, and a sender address - and generated a unique address you could give out, that was only valid for a certain time, for a certain set of senders.

If the system received a mail with a from address that didn't match the cryptologically signed to-address (e12e-xjjgff65477fc@example.com) - the mail was held back, and the system generated a reply, with a signed reply-to address. A sort of manual grey-listing.

Similarly, mail providers can come up with all sorts of different conventions if they want. For example, when setting up a new domain in FastMail, it offers the ability to accept anything@user.dom.ain and turn that into user+anything@dom.ain, and it offers user@anything.dom.ain which it will deliver to user@dom.ain. So here we already have two new conventions that sites can't possibly detect as alternatives to the normal foo+bar@dom.ain.

Why?

Why would anyone do that, when those digits can so easily be calculated or referenced from data files? Why do anything that is not strictly necessary? Why try to bench press more weight than last time? Why try to improve your chess game? Why learn a new programming language?

Because different people like different things. I am not required to like the things you like.

And I like proving to myself that I still can remember things without a helper daemon to keep track of them for me. I like that little bit of paranoid fantasy I have that makes me think that the men in black suits would have to take the pipe wrench to my kneecaps to get at my passwords, so I don't think about how the security at all these sites requiring password is so piss-poor that it would be easier to bypass all passwords in lieu of cracking just one of mine. In the end, the problem mentioned by the article is that very few people implementing computer security measures have any idea how to truly secure their data, so they do stupid shit like block clipboard pasting into password entry fields, or allow accounts to be hijacked by a spoofed SMS 2nd factor, or try to roll their own crypto without the requisite number of CS and math PhDs.

That's... not necessarily the case. You can implement that check by only storing hashes of previous passwords, or of patterns derived form them that are also forbidden (e.g. store a bcrypt of every previous password converted to all lowercase and with numbers and symbols removed).

Internally they still use Lotus notes 7.? last I heard. And storage limit was something like 100Mb if I recall correctly.

should satisfy you both right? I use the original or a form of usually when I had to check emails.

[0] https://security.stackexchange.com/a/53483