If you're security conscious, you shouldn't be typing passwords at all. You should generate them from a password manager and paste them into the field both times.
It boils down to security theater making us all less secure.
Also, if you're someone who uses a password manager, does disabling pasting really make you less secure? I assume you're still generating passwords; you just have to retype them. So maybe less convenient, but less secure is kind of a stretch. (By the way, I personally use KeePass, and I generally use auto-type instead of pasting, so I'm not inconvenienced at all.)
Allow pasted passwords if they meet a very high password-quality heuristic; deny them if they seem too guessable.
People will almost never manually type out high security (>20 random characters) passwords themselves. So if someone enters a high entropy password, you can fairly confident that mistyping is not an issue.
1) Aren't there people using generators like Diceware that don't do the password management part?
2) The industry's definition of "high security" is constantly changing. Password strength measurement makes assumptions about what is and isn't guessable, and a lot of that depends on what techniques the common brute-force crackers are employing. So finding the right heuristic is also problematic.
I'm not sure they're actually that common. Moreover, if someone is sophisticated enough to use a password generator I assume they have some sort of system for ensuring integrity.
Also, if you're worried about someone changing their password to something they don't know, simply force a relogin and have effective password reset mechanisms.
> 2) The industry's definition of "high security" is constantly changing.
Industry might be getting more serious about encouraging higher security passwords, but standards for high security passwords haven't really changed much. People are just becoming less tolerant of low-security ones.
In terms of estimating security, you can use something like https://github.com/dropbox/zxcvbn which does a pretty good job of evaluating entropy and resistance to brute force attacks. Ultimately, a password with sufficient entropy will be resistant to any brute force cracker.
isolate the users so they cannot destroy your system when they get hacked, because they will always get hacked.
No, I recognize that most users probably don't use password managers. But I'm not convinced that disabling pasting helps much.
For one thing, I don't actually think it's that common for someone to copy a mistyped password. Browsers disable copying from password fields, so they would have to type it in a third place and copy it into the fields from there. Most users are not sophisticated enough to do that.
> Also, if you're someone who uses a password manager, does disabling pasting really make you less secure?
It directly encourages people to use less secure passwords. If I try to manually retype a 50 character password myself, I'm very likely to make an error. This isn't theoretical—I've often purposefully lowered the complexity of passwords for sites with these kind of arbitrary restrictions.
It's too bad 1Password doesn't have an auto-type feature.
So I do think that retyping passwords has value, but disabling pasting may have questionable value. (In my experience, disabling pasting on email confirmation fields does reduce the rate of error there, since lots of people copy-paste)
Edit, threw an example together. Ignore the horrible code ;P
Http://jsfiddle.net/6gc2d6hb
Type in one of the PW fields then double-click it. Doesn't overwrite populated PW fields.
No. But, consider that the segment of your users who don't use password managers is also very likely 100% intersecting with the segment of your users who do not ever attempt to paste a password into a password field.
So by blocking paste you have zero effect on the users you wish would improve their password practices, and a 100% negative effect on the set of users who are creating and using secure passwords.
I guarantee you are wrong about this. For example, a lot of people receive passwords via email, and then paste them in.
That way, password manager users can paste into both fields, but users who are hand-typing are forced to avoid mistakes.
A user typing the password elsewhere probably means they were able to see it while they type, and are therefore less likely to make a mistake.
These days, I will refuse to log in to any website which doesn't support https.
A few years ago they dropped this requirement and you can now login using just an email and password.
The certificate-based identification process was really bad UI-wise so going with passwords probably helped them get more people to interact online instead of via paper forms.