If you disable pasting in your password field, I hate you.

[ben@mastodon.lubar.me]

@brainblasted the one silver lining of everything being a website nowadays is that you can potentially fix someone's intentionally broken password field

[cheappontoon@beige.party]

@ben @brainblasted this is relevant to my interests. How might I be able to do that?

I decided to wait and let the doctor read me my lab results because the lab test website — in advance of my next dr’s appointment — wouldn’t let me paste a password when I tried to create an account there

[ben@mastodon.lubar.me]

@CheapPontoon @brainblasted if you can find the password input field in the developer console, you can manipulate it directly

1. Ctrl+Shift+i to open the developer console in most browsers. If the website tries to stop you, you can do it in the address bar so it doesn't have a chance to intercept.
2. Go to the first tab (the one that has a bunch of lines of text starting with <) and find the password input. There's a button in every browser's developer tools to pick an element using your mouse, which can help on pages with complicated markup.
3. If there's not a text box at the bottom of the developer tools, hit the ESC key once to bring it up.
4. With the <input type="password" element still selected, type $0.value in the text box and press enter to see what password is in the box.
5. You can also type $0.value = prompt() to get a text box controlled by your browser that you can paste the password into

[ben@mastodon.lubar.me]

@CheapPontoon @brainblasted in some cases you might need to actually type something into the password field in order to make it activate, but you can just add any letter at the end of your password and then delete it

[xenophora@mastodon.art]

@brainblasted

[groan]

Hashtag: "Talks I Can't Believe We're Still Having In 2026."

[tillshadeisgone@blackqueer.life]

@brainblasted rarely have I wanted to punch someone through a computer more than when they do shit like that...

[ohmu@social.seattle.wa.us]

@brainblasted
instant follow

[bruce@darkmoon.social]

@brainblasted

Me: I'm being responsible. I use a password manager and unique, stupidly complex passwords.

Website: Haha! Fuck you.

[wideeyedcurious@mstdn.social]

@brainblasted I second that.

[theduesentrieb@social.linux.pizza]

@brainblasted there's a special place in hell, right after people that don't let you type out a date but force a date picker at you

[magnetic_tape@infosec.exchange]

@brainblasted
The underlaying issue here is that modern OSes generate a paste event instead of simulating a typing keycodes event which would prevent any shennigans like this to work in the first place

[kdude@mastodon.social]

@brainblasted so annoying... on desktops i have a system-wide keyboard shortcut which triggers "type the clipboard contents", as a workaround.

[cppguy@infosec.space]

@Kdude

Interesting! Which OS are you using, and how did you set up the shortcut?

@brainblasted

[fenixmaster@mastodon.social]

@brainblasted I use a simple paper boolet with A, B, C, .... and pretty complex passwords with subtitution parts, some more than 20 character long. The substitution parts are not known in the booklet, only in my mind. I never trust password managers.

[pascaline@mastodon.nl]

@brainblasted

Oh yes, that's so bad.
I have an app here on the phone that does not allow pasting. I've been silently ranting and raging about it. Internalisation is a thing.

[kdude@mastodon.social]

@CppGuy @brainblasted Linux: Espanso
Previously, macOS: Keyboard Maestro

https://espanso.org/docs/

[the5thcolumnist@mstdn.ca]

@brainblasted

Password show buttons should be de-rigour and obvious. Everyone is not entering passwords with someone looking over their shoulder, I would suggest most people are not,

[cbrocas@infosec.exchange]

@brainblasted I lived that particular moment so many times

[haayman@todon.nl]

@brainblasted Do you know what a bookmarklet is? It's a tiny javascript that you can add to your bookmarks at the top of the page. Instead of having an URL in the target, you add this script.
If you click on the link, it will find all password fields on the page and turn it into a regular input field to make the content visible. It is harmless and has no impact on the workings of the page

```
javascript:(function(){
document.querySelectorAll('input[type="password"]').forEach(el => el.type = 'text');})()
```

[brainblasted@crab.garden]

@haayman til! Thanks for the tip