Comment by cyphax | Hacker News Reader

Comment by cyphax | Hacker News Reader

I hope everybody who thinks it's a good idea to "forbid" pasting in password fields at least uses the same trick (onpaste="return false" or something similar) so that I can remove that attribute from the HTML before pasting my password like the insubordinate fool I am. :P

Blizzard does the same as Paypal, I noticed: not allowing pasting of passwords when changing passwords, but you can paste it when logging in. Thankfully, I noticed yesterday, Starcraft II allows me to paste the password in-game! That was a nice surprise. Looks like they've given their policy some thought, at least.

The only reason I can think of is perhaps reducing the risk of people not knowing their password when accidentally pasting the wrong thing in the password fields. It's possible that your clipboard contains something else since you copied your password. Which is understandable, but it seems to me like they're replacing one problem with another whereby everybody gets to deal with the new one, whereas the old problem could be circumvented with a password-forgotten function that everybody has anyway.

Yeah, not a big fan of this practice all in all.

You can automate this dom-manipulation with a browser plugin like DontFuckWithPaste, e.g. https://github.com/jswanner/DontFuckWithPaste

> It's possible that your clipboard contains something else since you copied your password.

Give me the option to view the password I've just entered, then, instead of obfuscating everything beyond comprehension. If I have to type my secure password, there's a good chance I'll introduce a typo anyway.

There's a _ton_ of issues with account stealing for Blizzard (selling WoW gold is profitable business, and stealing it from players is easier than farming it), so their password recovery process can be a bit... cumbersome.

Isn't it done to prevent some sort of exploit? Though I can't quite imaging what - selecting and copying (scraping) would be far more dangerous. The original exploit was of that type - a paper system console was replaced by a CRT, and some clever person sent a log message that did cursor-control, select and copy, and sent that back to themselves thus copying the sysadmin's login credential.

Disabling paste makes sense when setting your password.

If presented with two input fields for password & confirm your password, the lazy among us will type the desired new password in the first input box, then copy the contents and paste into the second... if you type it incorrectly in the first box you then have to reset it before you can log in again.

Browsers disable copy on password fields.

hah, I was in firefox at the time and checked that I can copy and paste between password fields, it appeared to work.

I didn't look at what had been inserted into the clipboard though, it was just the asterisk characters visually displayed in the password field.

Reply on news.ycombinator.com