|
How a developer who does not use a password manager would have known of such issues.
I am a developer and I don't trust much passwords manager so I never used one... (except the one in Windows for network drives) or individual site "remember my password" on some sites.
I would never have though that a password manager would have rely on paste...
In fact, copy and paste a password has not been allowed in many cases for so long that I haven't tried to copy a password into the confirm box since many years... if I have ever tried it. And obviously, I would have never tried the effect of pasting a password on web site I have developed. It does whatever the browser does by default for password field and I am not even sure of what is the default.
Philippe Mori
|
|
|
|
|
The thing is, the default properties of a password field are already handled correctly by the browser...allow paste, but not copy/cut. I can't think of a single reason why pasting should not be allowed for a password field.
Philippe Mori wrote: I would never have though that a password manager would have rely on paste...
Well, that's the real beauty of it to me. I wrote my own password manager, like I'm sure a lot of others here have done. I haven't had to type a username or password in years for most of the websites being managed. My process goes like this:
0: start the password manager and login
1: click the desired website from a list
2: click a button to copy the username to the clipboard
3: launch the site and paste in username
4: click a button to copy the password to the clipboard
5: paste into the password field and login. Done!
I refuse to let any browser remember my login credentials for any website, though they continue to ask.
Everything's stored in a password protected sqlce database, which works great since I can share it between multiple computers, and even use it on my laptop when away from the office.
"Go forth into the source" - Neal Morse
|
|
|
|
|
PeejayAdams wrote: a dev team making some really, really bad UX decisions?
As a developer who does UX, I can tell you it's simple. We're all f***ers.
Software Zen: delete this;
|
|
|
|
|
It's similar to how they set passwords to expire every 60 days forcing people to write down passwords and stick it on their monitors. Security through wrongly assumed obscurity.
|
|
|
|
|
"I don't use a password manager, so no-one needs one!"
Don't tell me you haven't worked with that guy.
I wanna be a eunuchs developer! Pass me a bread knife!
|
|
|
|
|
I once made a typo in my password that then allowed me to copy and paste the erred password into the confirm box. I had to beg IT to reset it for me.
|
|
|
|
|
I can tell you what it is: Internal or external security audit has roasted the dev team and they had to make it "more secure" while making it less user friendly at the same time. Happend to us!
|
|
|
|
|
This is the conundrum faced when personal responsibility is rejected in favor of having someone else handhold us though processes constantly.
Well meaning coders attempt to prevent someone from copying a incorrectly entered password in the first field into the verification field with these sort of measures. Why? To protect us from ourselves! If we were, to stupid to do such a thing then I guess we'd deserve not knowing what we entered for the password and having to reset it later right (at least that is the way I feel about it).
I agree, most users a going to fall on either side of that scenario where they might copy the bad password into the verification field. Instead the more novice user will actually type both fields content manually; where as the more advanced user will be working from a password generator or create a complex password, copy it to a safe then to the verification field.
It is one of the massive mistakes of our world to think that we can code correct the human flaw. We cannot. We can only provide for a means for them to resolve their error after the fact with a reset. To do anything else only frustrates the bulk of the user base.
|
|
|
|
|
What's in the clipboard? JavaScript / Flash can access the clipboard.
|
|
|
|
|
I would assume it's just about making sure the "confirm password" box does its job. Sometimes the clipboard isn't reliable (think screen sharing tools, this bites me all the time when a coworker and I are both looking at the same customer server). Sometimes you may think you hit ctrl-c but you really didn't for whatever reason, and now your password is whatever was sitting in your clipboard. Since they probably hide the password field you won't know what happened and your first interaction with their site will be the password reset page.
|
|
|
|
|
Try double clicking a word on this page. In both chrome and Edge when you double click to highlight a word you also get an extra space. So there is a very good chance that if you are copying and pasting a password you will end up with an extra space on the end that you did not intend to be there.
And all the people who say hackers don't use the front-end are very narrow-minded about what hackers do and how. Check out this story about someone used Selenium in a hack of Amazon that got the perpetrator millions of dollars.
Redirect Notice[^]
|
|
|
|
|
Disabling pasting just increases user error for those users copying from a password generator. What does make sense is to disable copying of the password field, so that people manually entering passwords can't just enter it, copy it, and then paste it. Those copying from another source such as a password generator can just paste twice, with little inconvenience.
|
|
|
|
|
Affirmative European votes on committee for arcane communication device (5, 5)
|
|
|
|
|
 Nice one!
Affirmative European votes QUI, JA
on committee BOARD
for arcane communication device
OUIJA BOARD
Bad command or file name. Bad, bad command! Sit! Stay! Staaaay...
|
|
|
|
|
|
Not really - I spent a good ten minutes on it!
Bad command or file name. Bad, bad command! Sit! Stay! Staaaay...
|
|
|
|
|
Once upon a time, everything was like vi and edlin: you had to remember keyboard shortcuts (which you could list on the screen -- if you could remember the keyboard shortcut to list keyboard shortcuts).
No-one was particularly happy with this, but it worked, so we used it.
To open programs, we had to type addresses and program names in little black boxes, which could be a pain, because after a while you have lots of programs and batch files, and you have to remember where they are and what they're called -- so programs like FIND soon became the most-used programs.
No-one was particularly happy with that, either, but it worked.
Then, someone brilliant thought of putting permanent bars at the top of program screens, with brackets around or underlines under the letters you had to press in combination with other keys -- and, eventually, microsoft took up that idea, as well, and added it to dos programs.
And everyone cheered!
Soon, an absolute genius thought: "Hey, we can turn that into a menu, so that instead of holding Alt and pressing letters, you just press Alt, then press the bracketed or underlined letter, and that drops down another list, where all you have to do is again press the bracketed or underlined letter!" -- and, eventually, microsoft took up that idea, as well, and added it to dos programs.
And everyone cheered!
Then a bunch of bright sparks who had nothing to do with microsoft, apple, google, ibm, or any of the other big names in computing, came up with the Graphical user interface, or GUI, and the words at the top of the program screens became buttons, which you could click with a mouse, as well as typing the bracketed or underlined letters -- and, eventually, microsoft took up that idea, as well, and made windows.
And everyone cheered!
The bright sparks who had nothing to do with microsoft, apple, google, ibm, or any of the other big names in computing also came up with the idea of using graphical shortcuts, little 64x64px borderless buttons, which you could double-click to open programs -- and, eventually, microsoft took up that idea, as well, and added it to windows.
And everyone cheered Loudly!
Then someone thought: "Hey, why do we have to use words, which take up a lot of space, at the top of program screens, when we can use little 32x32px buttons with pictures on them for each tool, rather than have to click through menus to get to them?" -- and, eventually, microsoft took up that idea, as well, and added it to windows.
And everyone cheered Really Loudly!
Then someone (who was not microsoft) thought: "Hey, menus are really easy to use, so why don't we add a menu for programs and stuff, rather than make people open lots of boxes to get to the graphical shortcuts?" -- and, eventually, microsoft took up that idea, as well, and added it to windows.
And everyone was ecstatic. They could access their tools the way they needed to, and they could access program functions the way they needed to.
Then microsoft got the idea that it should have ideas of its own on how GUIs should be, and mighty wars were fought within the company, promoting this stupid idea and that stupid idea, and, as it is written that it should be, the biggest mouths with the loudest voices won the day.
microsoft introduced the "(ef)fluent interface", commonly known as "the ribbon" and "that useless piece of cr@p", for accessing a reduced selection of program features and functions, whilst taking up four times the screen space, and forced it upon everyone, so everyone had to do without menus altogether, and put all the tools they use regularly in a single toolbar, which does not even have dividers.
And everyone said "WTF is this cr@p? Give us back the interface that wasn't broken!"
And microsoft introduced baby-blocks for accessing programs, which everyone gave up on, and went back to typing program names in boxes (white ones, this time) to open their programs
And everyone said "WTF is this cr@p? Give us back the interface that wasn't broken!"
But microsoft was very proud of itself, because had finally added things to the user interface that were theirs, and they could "patent". And, because they had ticked boxes and names had been made within the company, it didn't matter to microsoft that no-one in their right mind would ever want to lease such useless interface elements.
So microsoft lived happily ever after.
Only computer users suffered.
I wanna be a eunuchs developer! Pass me a bread knife!
|
|
|
|
|
Mark_Wallace wrote: we had to type addresses and program names in little black boxes
I still do that today, using the edit box in the start menu instead of the dos command line.
|
|
|
|
|
That's mentioned further down.
But, as you say, it's always been available as an option, which you're not alone in using (winkey + R always got plenty of use in my machines, especially for less-used programs, like regedit).
But with the baby-blocks interface, it became the only viable option, without installing third-party Start-menu tools. Fortunately, they backed off of the baby-blocks-only interface pretty quickly.
I wanna be a eunuchs developer! Pass me a bread knife!
|
|
|
|
|
Missed that one.
All in all, your thread is pretty accurate.
|
|
|
|
|
Not quite the only option - I pinned all my "frequently used" apps to the task bar, and forgot about the Start button, except to shut down.
Bad command or file name. Bad, bad command! Sit! Stay! Staaaay...
|
|
|
|
|
Hell, if I pinned all my frequently-used apps, I wouldn't have any room left on the taskbar for open programs/windows -- so I put the Quick Start toolbar back, which does exactly the same thing, but takes up much less space (my taskbar has been two buttons deep since windows '95).
I wanna be a eunuchs developer! Pass me a bread knife!
|
|
|
|
|
I've created hotkeys for my "frequently used" with AutoHotkey. The "not that frequently" used ones got a place on the task bar. And the rest gets started with "Win+R".
|
|
|
|
|
The reason I pin the "frequent" ones, is that they get "Pinned lists" - which means that VS has 5 pinned projects, Libreoffice Calc has four, and so on. Plus, they are always in the same order on the task bar while they are running, so it's easy to switch to them (quicker than the ALT TAB list in many cases).
Bad command or file name. Bad, bad command! Sit! Stay! Staaaay...
|
|
|
|
|
Yes, I was tempted by the pinned-list feature, until I discovered that it was part of internet explorer, rather than the desktop.
I couldn't figure out why that was, so I gave it a miss.
I wanna be a eunuchs developer! Pass me a bread knife!
|
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
