Password Manager

[#1]

I personally don't like to use the random password generator as I have a set of different passwords that I use on various websites that use a mixture of uppercase, lowercase, alpha numeric and special characters. I always type my password in when creating a new one, let the password manager save it and if I need reminding I will look it up on the password manager. I prefer to rely on my own memory, a bit like this XKCD about password strength...

But anyways, I have raised this with my team lead dev to speak to the devs on the mobile site and get these things looked into.

[#2]

While only scratching the surface of this topic, I've noted that Chrome's password manager does save the pw on the Mobile My Account login screen, and does permit copy/ paste in the pw field. This may not be relevant to creating the pw, or for other browsers, of course.

[#3]

It may well be a typical password that you use but most sites have restrictions on the maximum size of the password e.g. the size of the table column used to store it, so when using a 60 char one like this chances are that 40 or even more chars from it will be truncated, and you'd only know this if there was JS to say that the password was too long, but not many do they only report when it's short.

Edit:- Having read another post, I now know there were 3 sample passwords not a single one with line wrapping.

[#4]

@MarcJohnson that's right. That bits fine, it's just the generation bit that I was having a problem with

[#5]

@Anonymous that's another red herring too usually. If passwords are being hashed for storing (which they should be) then the size of the input is irrelevant (as is the character set used)

[#6]

You mean so a supplier can't ask for the (say) 1st and 3rd characters of you password to confirm they are talking to the account holder?

Now who do we know that does that...?

[#7]

Well yes, that’s exactly what is meant. When the password is passed to the system it hashes it using an algorithm of the vendors choice, and the resulting hash value is (should be) stored; not the password. So this means that the plain text password is being stored in order for a char by char lookup verification to be performed.

This :

ab207cff535471c22a0b8eca71acdf17

is an MD5 hash of a Windows ISO I have so if any bit and I mean bit of that file changes the hash generated will be totally different, informing you that someone (or something) has changed it.

As you’ll know this is the method used by many sites where they offer downloads to the public.

So when you log in to a system that uses approach the system will re-hash your password and check that it (the hash) matches the one stored. This also means that if the password database is compromised then all they have is a string of hashes.

Yes, I know there are ways to compare these hashes against known passwords (rainbow tables) but that's another discussion!

[#8]

As for the password copy/paste js.. I have done a bit of searching around and it seems to be a universally hated 'security standard' and there doesn't seem to be any kind of guidance on where it started and who first implemented it. Out of everything I read, this is one of the more reasonable arguments for using it that I found:

I fully disagree with you. The UK government has just launched the NCSC which as part of the GCHQ is responible for "National Cyber Security". 

Whilst I'm not saying that our government is the most technologically knowledgeable in the world, the GCHQ and therefore the NCSC are very capable in their job.

They posted a guidance about a month ago with the title "Let them paste passwords" https://www.ncsc.gov.uk/blog-post/let-them-paste-passwords

Certainly worth a read and VERY good advice in that article.

[#9]

Thank you for that link, it is a very interesting read (as well as the others that were provided). I did not know that this was such a hot topic as I had not personally come up against this issue in my own code or the code I am working on. At least in this article it confirms my suspicions that noone really knows where this originated from in the first place. This is all very interesting and something definately needs to be done.

I am gathering all of this evidence and we will raise this with the right people to get this properly looked at.

[#10]

I've hit just this problem and found this thread.  jaread83, I appreciate your enthusiasm, but 6 months later, the "new password" page neither allows pasting, nor does it even say you can't use '&' as a special character.  (In fact, I'm baffled as to why you limit the range of special characters at all.)

[#11]

Up until recently the PN mobile site was the only one I'd come across that didn't allow pasting of passwords.

I've just discovered that the government workplace pension site, NEST, doesn't allow pasting EITHER password OR username!.

Obviously the government don't listen to their own National Cyber Security Centre