If you disable pasting in your password field, I hate you.

[bruce@darkmoon.social]

@brainblasted

Me: I'm being responsible. I use a password manager and unique, stupidly complex passwords.

Website: Haha! Fuck you.

[wideeyedcurious@mstdn.social]

@brainblasted I second that.

[theduesentrieb@social.linux.pizza]

@brainblasted there's a special place in hell, right after people that don't let you type out a date but force a date picker at you

[magnetic_tape@infosec.exchange]

@brainblasted
The underlaying issue here is that modern OSes generate a paste event instead of simulating a typing keycodes event which would prevent any shennigans like this to work in the first place

[kdude@mastodon.social]

@brainblasted so annoying... on desktops i have a system-wide keyboard shortcut which triggers "type the clipboard contents", as a workaround.

[cppguy@infosec.space]

@Kdude

Interesting! Which OS are you using, and how did you set up the shortcut?

@brainblasted

[fenixmaster@mastodon.social]

@brainblasted I use a simple paper boolet with A, B, C, .... and pretty complex passwords with subtitution parts, some more than 20 character long. The substitution parts are not known in the booklet, only in my mind. I never trust password managers.

[pascaline@mastodon.nl]

@brainblasted

Oh yes, that's so bad.
I have an app here on the phone that does not allow pasting. I've been silently ranting and raging about it. Internalisation is a thing.

[kdude@mastodon.social]

@CppGuy @brainblasted Linux: Espanso
Previously, macOS: Keyboard Maestro

Getting Started | Espanso

In this section, we will cover the basics of Espanso to quickly get you started.

(espanso.org)

[the5thcolumnist@mstdn.ca]

@brainblasted

Password show buttons should be de-rigour and obvious. Everyone is not entering passwords with someone looking over their shoulder, I would suggest most people are not,

[cbrocas@infosec.exchange]

@brainblasted I lived that particular moment so many times

[haayman@todon.nl]

@brainblasted Do you know what a bookmarklet is? It's a tiny javascript that you can add to your bookmarks at the top of the page. Instead of having an URL in the target, you add this script.
If you click on the link, it will find all password fields on the page and turn it into a regular input field to make the content visible. It is harmless and has no impact on the workings of the page

```
javascript:(function(){
document.querySelectorAll('input[type="password"]').forEach(el => el.type = 'text');})()
```

[brainblasted@crab.garden]

@haayman til! Thanks for the tip

[cwant@mathstodon.xyz]

@brainblasted this is all true, but my least favorite is "I'm only gonna give you three tries then lock you out". (Nobody can brute force a password in three tries, so what problem is that solving?)

[larvitz@burningboard.net]

@brainblasted My previous bank has not only disabled "paste" in their iOS banking app login - they even implemented their *OWN ON-SCREEN KEYBOARD* for passwort entry.. (and that one was hardcoded to German qwertz layout ..)

[fentiger@mastodon.social]

@Larvitz @brainblasted For ultimate security, they should invent some special characters that are only found on their custom keyboard, and then require you to use them in your password.

[leeloo@chaosfem.tw]

@brainblasted
My password manager has an autotype function, rather than pasting the password, it sends the username and password as keystrokes.

[tarbh@mastodon.ie]

@leeloo @brainblasted What password manager is that?

[leeloo@chaosfem.tw]

@Tarbh @brainblasted
https://www.pwsafe.org/

[haayman@todon.nl]

@ben @CheapPontoon @brainblasted I may have an easier solution:
https://todon.nl/@haayman/116070020654615607