Pasting Passwords

[BobH]

Having returned to KeePass to generate and maintain separate passwords for each site I visit, I've been in the process of changing each one as I visit the site. Yesterday, I ran into a problem that I would like to see discussed by the cognoscenti here.


When I visited PayPal, I tried to change the old password. Of course, because I use long, complex, generated passwords, I copy and paste them into the required panels. But, PP does not allow this. Their software REQUIRES that you key your new password into 2 boxes and will not accept pasting.

Having encountered this, I used the Contact form at PP to complain of their design proscription and to suggest that they change it. I have had 2 responses. The first was apparently an automated response based on keywords in my text. Nothing in that response addressed any of issues or complaints I registered, failing utterly to even recognize them.

I sent a rather strong response by replying to their email AND GOT NO RESPONSE (at least not yet, and it's been several days).

Last night, I got a survey about my contact experience. Again, it appeared to be a canned, automated response. Again, I ranted back at them in the prescribed text boxes. So far, I've heard nothing from them.


So, other than venting some spleen, I've posted here because I would like to seek your views on the requirement that one key in a password twice. It seems to me that position conflicts and negates the use of really good security and password management practices.

What say you?

[viking33]

I don't know about Paypal but there are some sites that won't allow pasting but will, after you copy the password, allow Control V. Easy enough to try?

[StuartR]

I also usually find that Control-V allows me to paste passwords on most sites. Hang on and I'll check with PayPal...


...yep, it worked fine on the PayPal site.

[BobH]

Thanks for the suggestion, but Control-V would not work for me. I got the same nag message telling me not to paste.

[BobL]

I've not had that problem, but I do know that there are 2 ways to keyboard paste: CTRL-V and SHIFT-INS.
Maybe.....

[BobH]

Thanks, BobL.

Tried SHIFT-INS, too, and got the same nag message.

Is it just me, or do you think that PP is off base on this one, too?

[BobL]

Ok, pure speculation on this one, but it could be you (or your system).
Theory: I think your browser is auto-populating the password field with blanks. That would not allow you to paste a password in unless you 'remove' the blanks.
Try this: place your cursor in the password field - type CTRL-A (to select anything in that field) and then CTRL-V for pasting your password into the field.
If THAT doesn't work, I'm burnt out! But I still believe it's your system..
I always log into my PP account using the CTRL-V after copying it from another secure source and it 'always' works.

[BobH]

OK. I'm using Waterfox as my browser. Hmmm! Maybe that is the problem.

So, I uninstalled Waterfox and downloaded the latest and greatest Firefox and logged into PP with that. I checked the Profile menu item and Update Password options in the appropriate places. Everything looked exactly the same in one browser as the other (doh!). BUT . . . I still get the nag message about typing in the password.

As I said in an earlier post, I'm using KeePass (the free version) to generate and store passwords. I've tried using its "copy password" menu option and highlighting the password and using right-click and copy. Neither method works. I have the problem ONLY on pp's site. I can use the standard KeePass tools on every other website and account that I have password protected.

You can see in my signature line that I'm running Win 7 64 bit. Unless there is something that I don't know about in the copy and paste function of Win7, I don't know what else to check.

It's been another 48 hours with no response from PP to my contact other than the original auto-generated, keyword response. That's a real bummer.

[BobL]

Hmmm, maybe this is what is bonkers: I haven't tried changing passwords on PP - I was merely logging into my account.. I know that a lot of sites are complicating their 'new' passwords and they require a password to be defined as alpha plus numeric plus symbol - any combination but they do need to have all 3 in the password..
Yep - that be it... They must have custom (self programmed) password changing segments - and to 'change' a password you do need to individually enter each letter/character/number. Twice...
That in itself does make it difficult for passwords such as: 9wrs%$GI}mjul_kju
But they are in charge of their security and I suppose they feel it is worth it not to have spam-bots and the like infiltrate their ranks..

Guess it is something we need to live with - at least it is only on the changing that they require that, could be worse and on the the log in..

[BobH]

Thanks, BobL!

I keyed in a 20 character password loaded with upper and lower case numbers and a special character or 2 - generated by KeePass - in password change panels at PP. I figured that I would only have to go through the grief once, as you suggested. Their software said that my password was STRONG and said that the second entry matched the first saying that it was successful. HURRAY ! I thought. From now on I'll only have to copy and paste.

WRONG!!!

Pasting the pw takes me to the pw error screen where I try again to paste, to no avail. But the strange thing is that it will let me type in the monster password and it accepts it. ???????????

Figuring that I must have transposed some digits somewhere, I went back through the whole change procedure and of course THIS TIME I had to key in that monster string correctly to even get to the Profile menu option. Apparently, I made whatever typo again on this attempt and made it to the screen where I had to key 3 monster passwords again. Again, apparently, I typed the old password correctly again and was thus allowed to enter a new password. I had KeePass generate a new, even stronger pw which I then typed in twice and received the successful change message. This time when I logged out and logged in again, I was able to copy and paste the newly generated and installed pw and was successfully logged in.

I'm posting this example of my obvious ineptitude so that it might somehow benefit someone else in the future. I'm still convinced that the PP rules for entering new pw's need revision.

[BobL]

Thanks for the history - and that you made out A-Ok.
Big moral for this post is: Password Change is NOT the place for Fat Finger Joe! Caution rules.
But I can't blame PP at all - at least they are still covering us on their site. IMHO...

[viking33]

BobH,
I've been following this thread after my Control V suggestion, which didn't work?
Anyway, I must confess I really couldn't understand WHY it was only PayPal that was affected. Since I don't use PP, I couldn't offer any other advice but was glad that BobL, ( the other Bob ) jumped in to help. Still not quite sure if I understand how you worked it out but happy that all's well that ends well?
Did you go back to Waterfox?

[BobH]

Howdy, Bob!

I have not yet returned to Waterfox but intend to do so because I have the impression that it is faster (though, I cannot measure this objectively).

The CTL-V and CTL-INS suggestions did not work, nor did the suggestion to clear the panels with CTL-A beforehand. In the end, I had to resort to keying in all the passwords. The 'original' old password was easy, but the new password was generated with KeePass using its strongest algorithm resulting in a mix of special characters, numbers, and upper and lower case letters, 20 characters in all.

I was able to key them in by shrinking the GUIs for PP and for KeePass in order to display both onscreen. Careful single key selection got me to a confirmation screen saying that the password was changed successfully. In this process, I must have phat phingered in the same manner twice because the 2 pw's matched; however, when I then tried to logout and log back in by copying and pasting the pw from KeePass that I thought I had entered correctly, I got a pw error. At this point, I had a new password at PP that I could not replicate by copying and pasting. So . . . I did the split screen and carefully entered the KeePass value into the PP old password box. Again, I must have made the same keying error because PP accepted what I keyed but not what I pasted. I'm laying that to old age and inattention (although I was being as careful as I know how to be). At this point, I copied the KeePass value and then had KeePass generate another new pw which I again carefully keyed in twice using the split screen. Again, I got the 'successfully changed password' message from PP. I logged out again then logged in again. I was able to copy and paste the new KeePass pw into the PP login in pw field and was successfully logged in. I can now copy and paste to login but I cannot copy and paste to change passwords.

I find this a bizarre limitation imposed by PP, but at least I got a work-around. PP is the only website I have encountered that has this limitation.

[viking33]

BobH,
OK I think I have a better understanding of this now.
You really should try typing without those old leather work gloves on!
Glad it's working now. Waterfox is a little faster as the 64 bit version of Fx but can't supply measurable facts of same.

[BobH]

BobH,
OK I think I have a better understanding of this now.
You really should try typing without those old leather work gloves on!
Glad it's working now. Waterfox is a little faster as the 64 bit version of Fx but can't supply measurable facts of same.

Where's the challenge in that?

[viking33]

BobH,
OK I think I have a better understanding of this now.
You really should try typing without those old leather work gloves on!
Glad it's working now. Waterfox is a little faster as the 64 bit version of Fx but can't supply measurable facts of same.

Where's the challenge in that?

Try boxing gloves. Now there is a challenge!!

[BobH]

Try boxing gloves. Now there is a challenge!!

Touché!

[StuartR]

Touché!

That would require fencing gloves.