Always Allow the User to Paste into Password Fields
It’s difficult to fathom where this pattern of disabling paste came from or what possible security issue it’s supposed to address. Back in the 1990s, “webmasters” would disable right-click to prevent users from copying images. This worked for about 5 seconds, until people realized that they could just screen capture the image. Using some JavaScript on the page to prevent users from pasting into a password field is insane and potentially harmful for security.
Figure 41.1: Screenshot from security expert Troy Hunt’s blog post, “The ‘Cobra Effect’”: https://www.troyhunt.com/the-cobra-effect-that-is-disabling/
A user with a password manager app will have a long, impossible-to-remember password that has to be pasted into the field (especially on mobile, where it’s more tricky to autofill the field). However, disabling paste in a password field forces users...
