The “Cobra Effect” that is disabling paste on password fields

Re:The “Cobra Effect” that is disabling paste on password fi... by iancarroll on Sunday June 26, 2016 @03:12AM (#11979753)

This one at least makes some sort of sense; it's designed to prevent keyloggers from reading your password when you type it in. You can just MiTM the connection though.

[ Parent | on HN ]

Re:The “Cobra Effect” that is disabling paste on password fi... by phlo on Sunday June 26, 2016 @09:10AM (#11980605)

It doesn't. Today's banking malware will capture the form values on submit, either as text or as a screenshot. And it will do so, silently, every time you log in.

All this scheme does is limit an attacker to gathering three letters per login attempt. Given an eight-letter password, three logins will probably disclose most of it; or at least enough for an attacker to pass the challenge when he tries to log in.

In addition, if the attacker is actually interested in your data, he can easily inject a fake "wrong password" message after your first attempt and have you try again, gathering 6 characters per login.

[ Parent | on HN ]

Re:The “Cobra Effect” that is disabling paste on password fi... by fpoling on Sunday June 26, 2016 @03:36AM (#11979808)

Modern keyloggers track mouse and take screenshots on clicks.

[ Parent | on HN ]

Re:The “Cobra Effect” that is disabling paste on password fi... by bruce_one on Sunday June 26, 2016 @03:57AM (#11979842)

I know of some of those sites that randomise the location of keys and then hide the key labels on mousedown, I assume to try and avert that issue.

(Curious as to whether it would actually work though.)

[ Parent | on HN ]

Re:The “Cobra Effect” that is disabling paste on password fi... by TheSmiddy on Sunday June 26, 2016 @04:01AM (#11979848)

A hacker can get around that by also taking a screenshot when there is no mousedown event, it's literally one extra line of code.

[ Parent | on HN ]

Re:The “Cobra Effect” that is disabling paste on password fi... by fpoling on Sunday June 26, 2016 @05:22AM (#11980001)

Or just take screenshots periodically each second and then submit with a mouse click the one before the click.

[ Parent | on HN ]

Re:The “Cobra Effect” that is disabling paste on password fi... by joosters on Sunday June 26, 2016 @07:50AM (#11980408)

It still doesn't work when the bank asks for different characters the next time you connect.

[ Parent | on HN ]