Hacker Bits, August 2016

Figure 1: PayPal's change password page
Ok, you get a message
which is nice, but zero info on
why you shouldn’t be pasting in
your password. I’ll come back
to this example later on though
because there are other things
going on here which help explain
their rationale.
Before we go on though,
let’s take a quick look at the
mechanics behind the anti-paste
mechanism so we can better understand
what goes into saving
us from ourselves.
The mechanics of an
anti-password-paster
Right, let’s drill into this and
see what’s going on behind the
scenes. We’ll pick someone different
this time. Let’s try the Al
Rajhi Bank in Saudi Arabia just
for a change of flavour.
As you can see below, I’ve
typed in a username and pasted
a password:
Yeah, about that password…
anyway, the question remains,
what voodoo is breaking this
most fundamental of behaviours?
For Al Rajhi, it’s very
simple:
That’s it — the onpaste
event is returning false. Sound
unfamiliar? I mean the onpaste
event? Yes, it’s a thing, here’s a
JSFiddler so you can play with it
yourself.
But there’s also this regarding
the event:
Non-standard event defined
by Microsoft for use
in Internet Explorer.
C’mon guys, we’ve been
down the non-standard implementations
in browsers before
and it always ends in tears.
Thing is though, not only
does it work in IE but it works
in Chrome too. And Safari. And
Firefox. And even if it didn’t,
there are always bright JavaScript
ideas to “hack” the ability
of CTRL-V out of browsers.
The point is that there are
many ways of skinning this cat
and it can be very easy. However,
it’s a conscious decision
— the developer has to say “You
know, I really don’t think people
need a paste facility; I’m gonna
kill it”.
But of course we really
should touch on why people
want to paste into password
fields to begin with, so let’s cover
that now.
Why on earth would
you want to paste a
password anyway?!
The argument of whether you
should use a password or a
passphrase or just let the cat
wander over the keyboard and
see what happens has been well
and truly had, and in the end it
always comes back to this: The
only secure password is the one
you can’t remember.
If you haven’t already
reached this enlightened state
then free yourself from the
shackles of human memory-based
passwords and grab
1Password or KeePass or Last-
Pass.
20 hacker bits