Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

No. As long as mediocre programmers and organizations require BLIND entry of very complicated passwords on mobile phone teeny weeny virtual keyboards TWICE, nothing will get better.

Nothing will get better because most organizations are on autopilot, only doing "best practices" even when those practices don't make any sense. For instance, typing passwords blind. It exists because CRT terminals had a wide field of view. Flat screens have a marrow field of view, and further, in the form of cellphones, are small and held close to the face. There is no reason to require blind password entry, yet it persists. All of this points to stasis, nothing getting better, and the situation probably getting worse, since there's no upside for anyone contradicting "best practices".



We regularly get "pentest" results where the top recommendation is to disable pasting of passwords.


What is the idea behind this? The only thing I can think of (I’m not a web developer, so might be missing something obvious) is that it would ‘stop’ third party tools from being able to automate the login flow. But if that was the case, couldn’t they just change the html/JavaScript to allow pasting again? As far as I know, blocking of pasting into forms is a fully client-side setting.


I presume it's because when you copy a password to the clipboard, another app can view it.


Isn't that the browser makers fault if there's no reveal button on a password input?


What about apps?


Why aren't you using a password manager to fill those field's automatically?




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: