It’s 2023, why are websites actively preventing pasting into fields like passwords and credit card number boxes? I use a password manager for security, it’s recommended by my employer to use one, and it even avoids human error like accidentally fat-fingering keys, and best of all with the credit card number I don’t have to memorize anything or know a single digit/character!
I have to use the Don’t Fuck With Paste addon just to be able to paste my secrets into certain monthly billing websites; why is my electric provider and one of my banks so asinine that pasting cannot be allowed? I can only imagine downsides and zero upsides to this toxic dark-pattern behavior.
There is even a mention about this in NIST SP 800-63B, a standard for identity management that some companies must follow in the USA, which mentions forcefully rotating passwords and denying “password paste-in” as antiquated/bad advice:
Verifiers SHOULD permit claimants to use “paste” functionality when entering a memorized secret. This facilitates the use of password managers, which are widely used and in many cases increase the likelihood that users will choose stronger memorized secrets
Edit: I discovered that for Firefox users there’s a simpler way than exposing your secrets to someone’s third-party addon. Simply open about:config, search for dom.event.clipboardevents.enabled, and change it from true to false.
Edit 2: As some have pointed out, that config value interferes with regular functionality on some sites. Probably best to leave it alone unless you know what you’re doing.
Do NOT do this unless you absolutely know what you are doing and it will break legitimate uses of clipboard on websites. Use it one time and revert immediately.
Yeah, that seems like it would be a problem for a bunch of sites. Anything with rich text like Google Docs or somewhere you paste images to upload them seems like it could be broken by disabling all clipboard events.
I am curious, what will it break?
It prevents any website being able to run intercepts on pasting. This is good when they’re using it to just prevent you from doing it for no real reason but there are many situations where you don’t want a user to be able to arbitrarily just drop text into a text field.
The big one is 2fa. A lot of the time you might need to enter a five digit code and each number may need to be entered into a particular box if you just click in the first box and press paste after copying the code from an email then it’ll paste the entire contents into that one box. You don’t want that you want some code to automatically paste each letter into each subsequent box, that requires you intercept the original paste command.
One big use is the ability to copy and paste images, like imgur or (my use case) Whatsapp Web. I’ve heard Google Docs acts poorly as well.