• @nucleative
    link
    English
    33 hours ago

    My bank uses a TOTP and they not only block paste, they also block all typing. Instead they popup a modal with a 0-9 digit keypand and the location of each number changes every time.

    Effing obnoxious.

      • @cm0002OP
        link
        13 hours ago

        Lmao I was just about to comment, their bank must have hired a UX designer from Jagex lol

  • layzerjeyt
    link
    fedilink
    88 hours ago

    My impression from when I’ve encountered this is that it is an attempt to repel bots.

    Speculating/knowing about the reason doesn’t help when I’m confronted with having to input the password *6mA*P7CCuVyHo8kh%x34!63wm23&uhzSMY3Xy3$*8^%7j$VeH^7

    • @nucleative
      link
      English
      23 hours ago

      Bots don’t paste. If it a selenium related bot it would inject the value or type out each keypress.

      It only causes real users pain

    • @[email protected]
      link
      fedilink
      English
      87 hours ago

      My impression from when I’ve encountered this is that it is an attempt to repel bots.

      hmm bots don’t use keyboard or mouse copy & paste so I don’t see how that makes sense?

      my impression is this is just stupid product managers who don’t understand why it’s a bad idea to force all your users to manually type out their passwords or email addresses just because of the 0.1% of people who would copy and paste one with an error in.

    • @[email protected]
      link
      fedilink
      3
      edit-2
      7 hours ago

      Weird, that’s one character off from my Paramount+ password. I know from typing it on every fucking STB and console that I own and painstakingly quadruple-checking each character when it fails.

      You’d think I’d just change to a passphrase but nah. Ain’t nobody got time for that. Too busy ranting about user unfriendly problems that shouldn’t exist in modern STB apps.

  • Laurel Raven
    link
    fedilink
    English
    79 hours ago

    Let’s be real, though, it’s not the dev we should be mad at but some suit who thinks they know security demanding it be done that way

  • @[email protected]
    link
    fedilink
    English
    49 hours ago

    On a similar note, by mobile lemmy client won’t let me copy test. Can’t even select it.

    • @A7thStone
      link
      38 hours ago

      If you are using Voyager you can hold down on the comment or hit the three dot button and you’ll get a menu that gives you a “select text” option. I was annoyed by that until I found it.

        • @[email protected]
          link
          fedilink
          English
          2
          edit-2
          3 hours ago

          You actually have multiple options. They all work for posts and comments.

          • ⋮ / View Source
          • Reply (above the text field, the source of the parent post/comment is visible and selectable)
          • ⋮ / Copy / Copy Comment Text (for a copy-all operation, obviously; you caan also copy permalinks, post titles and URLs)

          How did you not notice? Also, it’s expected behavior that you can’t just copy text from the comment view, and making ot work with rendered Markdown would be difficult.

            • @[email protected]
              link
              fedilink
              English
              13 hours ago

              They might be new to Lemmy, the account is less than 2 weeks old… but I always snoop around the options of apps soon after I install them. My phone can’t send an ICBM launch order so it’s usually fine but I don’t know about theirs.

      • Victor
        link
        18 hours ago

        Also curious.

  • AwkwardLookMonkeyPuppet
    link
    English
    2518 hours ago

    Especially for things like account numbers. No, you’re not increasing security, you idiots, you’re increasing human error!

    • @[email protected]
      link
      fedilink
      27 hours ago

      Yep. It’s always when I’m adding a payment method to like a credit card or something.

      The ones that are web-based and block password vault auto fill…on desktop…those really grind my gears.

      Also, is it me, or is android really bad about detecting when something is a username/password field and the vault auto fill should be suggested

    • @cm0002OP
      link
      418 hours ago

      Lol yea the comic artist needs to come up with a follow-up 4panel with extra-extra-hell lmao

  • @[email protected]
    link
    fedilink
    481 day ago

    I ran into this when trying to paste my generated password into the password field on some kind of financial site and I think it is still the most egregious case of security theater I’ve seen yet.

    Anyway, you want the “don’t fuck with paste” extension, available on both chrome and firefox.

    • @[email protected]
      link
      fedilink
      English
      43
      edit-2
      21 hours ago

      You don’t need this - In about:config, set dom.event.clipboardevents.enabled to false. No Addon needed.

      • @[email protected]
        link
        fedilink
        115 hours ago

        Nice, didn’t know about that one. I imagine there are side effects to disabling it globally though? Those goofy OTP code inputs implemented as six single digit inputs jumps to mind, they probably rely on the paste event. The extension works similarly but lets you only enable it for problematic sites.

        • @brygphilomena
          link
          410 hours ago

          I have an auto hotkey script that I always have running. It just takes my clipboard and sends the key presses to type it in when I press Ctrl + shift + v.

          It gets me around most of this sort of bullshit.

        • @[email protected]
          link
          fedilink
          English
          1
          edit-2
          12 hours ago

          I just found it recently when DFWP failed to allow me to paste on a site (which happens quite often in my experience). I had the same thoughts about this setting but so far I haven’t noticed anything. I keep it open in a tab in case I need to toggle it though.

  • @otacon239
    link
    1211 day ago

    Just as evil are the pages that don’t let you select text or pictures for copying.

    • @Stovetop
      link
      811 day ago

      You can’t copy our JPEGs! That’s stealing! If you want to look at these JPEGs whenever you want, you need to register for an account and tag your favorites so we can monitor your viewing habits and sell your personality profile to advertisers and government entities!

      • @[email protected]
        link
        fedilink
        422 hours ago

        I believe you can hold ALT then select on Firefox when that comes up, but I don’t think I’ve seen it in years.

    • @50MYT
      link
      161 day ago

      Or training videos that pause if the window playing the video is not the last thing clicked on.

  • @Alexstarfire
    link
    251 day ago

    TBF, I kind of get it. If someone is using a public computer you wouldn’t want someone to be able to sign into a site they left open because they copied their password.

    However, this won’t prevent anyone from copying the password into something like notepad and just typing it out. So in the end, it’s useless and makes things less user friendly. Which is what I expect these days.

    • Kairos
      link
      fedilink
      7
      edit-2
      16 hours ago
      1. User pastes something into site
      2. data still pasted as normal
      3. JScript event clears clipboard and tells user that their clipboard was safely cleared.

      Literally just as secure and better behavior. Just use your brain for a few seconds.

      Edit: Actually it’s MORE secure because disallowing paste leaves the password or whatever in the clipboard without the user necessarily realizing it…

    • @[email protected]
      link
      fedilink
      English
      519 hours ago

      Public computers should just have their pastebin locked.

      They shouldn’t mess with things on my personal computer.

      • AwkwardLookMonkeyPuppet
        link
        English
        918 hours ago

        No they shouldn’t. They should require a guest account that clears the session on logout. If you fail to log out when you’re finished, well, mistakes have consequences. I’m tired of being handcuffed so incompetent people can have their hands held.

    • @hikaru755
      link
      211 day ago

      I suspect the reasoning for it was more along the lines of “if you’re pasting the password, that means you probably saved it in a text file on your desktop or something, and you shouldn’t do that so let’s stop you from doing it”. In reality, it probably didn’t work to make anyone store passwords more securely, and only made life unnecessarily harder for people with password managers

  • @Dagnet
    link
    171 day ago

    Came here hoping someone would explain how to use dev tools to remove that block or if there an addon for that, really hate this kind of restriction

    • @[email protected]
      link
      fedilink
      2
      edit-2
      8 hours ago

      if you don’t want to or can’t use extensions, just right click > inspect on the password field, then right click the element highlighted in the HTML and click “use in console” or “store in global variable” depending on browser

      it’ll put something like

      temp0 into the console

      just change that line to

      temp0.value = "yourpassword"
      ```  and press enter
      
      it sounds verbose to explain but it's just a couple of clicks and one command, if you're using a password manager it's still a lot easier than typing out a random string and it should work with most text boxes and inputs, might not work if the page is doing something fancy.
      
    • @[email protected]
      link
      fedilink
      English
      118 hours ago

      On macOS:

      Love that Keyboard Maestro has an “Insert Text By Typing” feature/macro where text streams from your cursor :)

    • @[email protected]
      link
      fedilink
      English
      101 day ago

      Firefox often let’s you bypass this shit with holding shift + right click or select the text you want to paste and drag and drop it into the field.

      • @Dagnet
        link
        English
        51 day ago

        deleted by creator

      • @Dagnet
        link
        English
        21 day ago

        Man, that extension fucked with my Vivaldi. I couldnt send msgs on Twitch, couldnt delete cells on GoogleSheets and spent like an hour trying to figure out what caused it. Not worth the trouble tbh

        • @[email protected]
          link
          fedilink
          11 day ago

          Also on vivaldi, I now have three extensions that destroy half the pages on the web (and save the other half). With a little bit of whitelisting or just temporarily enabling, they work fine.

  • Beacon
    link
    fedilink
    151 day ago

    You can sometimes do it anyway by right clicking (or long hold tap) on the text field to get a contextual menu popup

    • @cm0002OP
      link
      181 day ago

      They’ve started blocking that too on phones, which is what led to this meme lol. Curiously, GBoard has a little button on the top row that shows for freshly copied text when you go into a text field that still works, GBoard must not send the text as a paste when it’s done that way. But its only visible once

      • @[email protected]
        link
        fedilink
        21 day ago

        Unexpected Keyboard has a similar optional key — which website are you using with this behavior? I wonder if pasting from it would trigger the detection. Also, it lets you bind strings to keys — I wonder if that would act in a similar manner.

        • @cm0002OP
          link
          11 day ago

          So far, it’s worked wherever Ive encountered the “advanced” paste blocking. Just recently, my bank loan payment form has done this that I needed to use the “last resort” option lmao

    • AwkwardLookMonkeyPuppet
      link
      English
      317 hours ago

      Well, stop. The problem is caused by mid-level managers who think they know better than the Worldwide Web Consortium.