The “Cobra Effect” that is disabling paste on password fields

Re:The “Cobra Effect” that is disabling paste on password fi... by ezzaf on Sunday June 26, 2016 @08:43PM (#11983579)

I actually like this as implemented by one of my banks. The 'pick a few letters' part of the login is pulled from a list of secret question answers rather than the password itself, and is presented after successfully entering the password.

So my password manager enters my password, and then on the next screen I am asked for the (for example) 4th and 5th letters of the street I grew up on. The requested letters change and the question is pulled from a saved list of question/answer pairs.

I am not aware of how the bank deals with accessibility limitations of this system.

[ Parent | on HN ]

Re:The “Cobra Effect” that is disabling paste on password fi... by WorldMaker on Monday June 27, 2016 @02:26PM (#11988272)

But that doesn't solve the problem that all of that is still "Wish-It-Were-Two-Factor". Secret questions and secret answers are still passwords by a different name. (At this point I even keep them in the same password vault and am starting to pseudorandom generate them thanks to support lines treating them as passwords and giving people access to accounts based on easy to find knowledge.)

Instead of all the work banks put into chicanery around this secret question and answer security theater, they should just roll out real Two Factor and save us all some hassle.

[ Parent | on HN ]