Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!news.glorb.com!feeder.erje.net!eu.feeder.erje.net!news-1.dfn.de!news.dfn.de!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail
From: Sylvia Else <sylvia@not.at.this.address>
Newsgroups: comp.misc
Subject: Re: The "Cobra Effect" that is disabling paste on password fields
Date: Tue, 03 Jun 2014 13:15:15 +1000
Lines: 22
Message-ID: <bv4su5Fb08cU1@mid.individual.net>
References: <lmhokh$2kb$1@dont-email.me> <6242#28221@usenet.squte.com> <lmi5du$15e$1@dont-email.me>
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-Trace: individual.net mnf1eK33M6yZIN89FUwDrgfqK0YK4LWoAnfkH/C9UZ9Hw4kidh
Cancel-Lock: sha1:EmnZNHNULZURNnXqD9jc/qe0h/Y=
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:24.0) Gecko/20100101 Thunderbird/24.5.0
In-Reply-To: <lmi5du$15e$1@dont-email.me>
Xref: csiph.com comp.misc:3497

On 3/06/2014 1:32 AM, Rich wrote:
> tdk <forum.tdk@squte.com> wrote:
>>> We'd lose our security certificate if we allowed pasting. It could leave us
>>> open to a "brute force" attack.
>
>> It is of course ridiculous to think that brute forcing is done by
>> copy-pasting (with JavaScript enabled!)
>
> But it looks like some "web-security best practices seminar" somewhere
> has begun to "teach" that allowing pasting is a security issue.  The
> question is, how do we stop it before it grows too far?

We could try to find out where this nonsense is coming from.

Or we could just program around it. I doubt it would be that difficult 
to allow a program to insert characters into the keyboard input stream 
so that another program sees them as if they're actually been typed.

Of course, that may have security implications too....

Sylvia.