Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.misc > #3510

Re: The "Cobra Effect" that is disabling paste on password fields

Show all headers | View raw

Sylvia Else <sylvia@not.at.this.address> wrote:
> On 4/06/2014 11:45 AM, Rich wrote:
> > Jerry Peters <jerry@example.invalid> wrote:
> >> Rich <rich@example.invalid> wrote:
> >>> Sylvia Else <sylvia@not.at.this.address> wrote:
> >>>> On 3/06/2014 1:32 AM, Rich wrote:
> >>>>> tdk <forum.tdk@squte.com> wrote:
> >>>>>>> We'd lose our security certificate if we allowed pasting. It could leave us
> >>>>>>> open to a "brute force" attack.
> >>>>>
> >>>>>> It is of course ridiculous to think that brute forcing is done by
> >>>>>> copy-pasting (with JavaScript enabled!)
> >>>>>
> >>>>> But it looks like some "web-security best practices seminar" somewhere
> >>>>> has begun to "teach" that allowing pasting is a security issue.  The
> >>>>> question is, how do we stop it before it grows too far?
> >>>
> >>>> We could try to find out where this nonsense is coming from.
> >>>
> >>>> Or we could just program around it. I doubt it would be that difficult
> >>>> to allow a program to insert characters into the keyboard input stream
> >>>> so that another program sees them as if they're actually been typed.
> >>>
> >>> Another option might be a bookmarklet that iterated the document.forms
> >>> DOM object, looking for inputs with an onpaste event attached, and then
> >>> simply removing the onpaste event(s).
> >>>
> >>> That seems to be how the fools are blocking pasting, setting the
> >>> onpaste event of the DOM input element that is the password box to
> >>> return false.
> >>>
> >
> >> I have a FF bookmarklet that purports to do just that. Haven't tried
> >> it yet:
> >
> > It does indeed "unset" any set onpaste event.  Reformatting it
> > slightly, and adding some comments:
> >
> > javascript:( function(){
> >
> >    /* get all <input> tags */
> >    var inputs=document.getElementsByTagName('input');
> >
> >    /* iterate over each <input> tag */
> >    for (var i=0; i<inputs.length; i++) {
> >
> >      /* check to see if the <input> is type="password" */
> >      if (inputs[i].getAttribute('type').toLowerCase()==='password') {
> >
> >        /* if yes, set onpaste='' (nothing) */
> >        inputs[i].setAttribute('onpaste','');
> >      }
> >    }
> >   })();
> >

> It's specifically targeted at password fields.

That is true - I did not attempt to extend it in any way yet.

> I'm trying to think whether there's any valid reason (from a user's
> perspective) for ever prohibiting paste into fields, whether password
> or not.

For prohibiting paste, no, I don't see any valid reason.  For catching
a paste event to a field so that the code can do the right thing
(whatever that might be) for a web-app then there might be a reason.

If you wanted to undo all paste overrides, just remove the if clause
that checks for 'type' == 'password' and it will clear the onpaste=''
attribute of every single <input> field.  That would leave
<textareas> unchanged, so the code might need a bit of expansion to
work on both <input> and <textarea> (that is assuming that someone
would try to block paste into a text area).  I hope no one would do
that, but sadly, I suspect some fool does somewhere.

Back to comp.misc | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

The "Cobra Effect" that is disabling paste on password fields Rich <rich@example.invalid> - 2014-06-02 11:53 +0000
  Re: The "Cobra Effect" that is disabling paste on password fields "tdk" <forum.tdk@squte.com> - 2014-06-02 08:27 -0500
    Re: The "Cobra Effect" that is disabling paste on password fields Rich <rich@example.invalid> - 2014-06-02 15:32 +0000
      Re: The "Cobra Effect" that is disabling paste on password fields Jerry Peters <jerry@example.invalid> - 2014-06-02 18:31 +0000
      Re: The "Cobra Effect" that is disabling paste on password fields Sylvia Else <sylvia@not.at.this.address> - 2014-06-03 13:15 +1000
        Re: The "Cobra Effect" that is disabling paste on password fields Rich <rich@example.invalid> - 2014-06-03 10:26 +0000
          Re: The "Cobra Effect" that is disabling paste on password fields Sylvia Else <sylvia@not.at.this.address> - 2014-06-03 21:03 +1000
          Re: The "Cobra Effect" that is disabling paste on password fields Jerry Peters <jerry@example.invalid> - 2014-06-03 20:20 +0000
            Re: The "Cobra Effect" that is disabling paste on password fields Rich <rich@example.invalid> - 2014-06-04 01:45 +0000
              Re: The "Cobra Effect" that is disabling paste on password fields Sylvia Else <sylvia@not.at.this.address> - 2014-06-04 17:16 +1000
                Re: The "Cobra Effect" that is disabling paste on password fields Rich <rich@example.invalid> - 2014-06-04 09:37 +0000
              Re: The "Cobra Effect" that is disabling paste on password fields Jerry Peters <jerry@example.invalid> - 2014-06-04 20:15 +0000
        Re: The "Cobra Effect" that is disabling paste on password fields Ben Bacarisse <ben.usenet@bsb.me.uk> - 2014-06-04 11:06 +0100
      Re: The "Cobra Effect" that is disabling paste on password fields Huge <Huge@nowhere.much.invalid> - 2014-06-05 18:41 +0000
    Re: The "Cobra Effect" that is disabling paste on password fields Paul Sture <nospam@sture.ch> - 2014-06-04 07:19 +0200
      Re: The "Cobra Effect" that is disabling paste on password fields Rich <rich@example.invalid> - 2014-06-04 10:00 +0000
        Re: The "Cobra Effect" that is disabling paste on password fields David Harmon <source@netcom.com> - 2014-06-04 07:54 -0700
        Re: The "Cobra Effect" that is disabling paste on password fields Mike Spencer <mds@bogus.nodomain.nowhere> - 2014-06-04 23:49 -0300
          Re: The "Cobra Effect" that is disabling paste on password fields "tdk" <forum.tdk@squte.com> - 2014-06-05 05:55 -0500
  Re: The "Cobra Effect" that is disabling paste on password fields Gordon Henderson <gordon+usenet@drogon.net> - 2014-06-03 07:42 +0000
    Re: The "Cobra Effect" that is disabling paste on password fields polygonum <rmoudndgers@vrod.co.uk> - 2014-06-03 18:39 +0100
    Re: The "Cobra Effect" that is disabling paste on password fields scott@alfter.diespammersdie.us (Scott Alfter) - 2014-06-04 16:00 +0000

csiph-web