#Hacktivity2020 // Paste Wars: fighting for copypaste freedom by Ignat Korchagin

### Overview In this talk, Ignat Korchagin discusses the friction between password security best practices and web services that actively block copy-paste functionality in password input fields. While modern password security relies heavily on password managers generating long, complex, random, and unique passwords, blocking paste operations disrupts this security model and forces users into insecure habits. Korchagin analyzes the ineffective workarounds commonly used to bypass paste restrictions and introduces an OS-level tool, `passkb`, designed to simulate physical keystrokes and render client-side paste blocking obsolete.

### Key Topics - **Password Complexity and Password Managers**: Passwords face attacks ranging from brute-force and dictionary attacks to client-side phishing and server-side breaches. To mitigate these, modern passwords must be long, unique, and random, necessitating password managers that encrypt credentials under a single master key. - **Why Web Services Block Paste**: Citing investigations by Troy Hunt, the speaker notes common developer rationales for blocking clipboard paste: unfounded fears of clipboard malware (ignoring that keystroke loggers pose the same threat), misguided beliefs about stopping brute-force attacks, vague compliance claims, or organizational inertia. - **Shortcomings of Browser-Level Workarounds**: - Disabling clipboard/paste events in browser configuration (such as Firefox's settings) lacks portability, fails against other detection events, and breaks legitimate modern reactive web app features. - Browser extensions either inject JavaScript to neutralize paste filters or autofill fields directly via DOM manipulation. However, these extensions introduce security risks: they require broad permissions to read and modify all browsing data, run with network access, and present an attractive target for extension hijacking.

### Technical Details To solve this cleanly, Korchagin presents an operating system–level approach that bypasses web-layer paste blocking entirely. Rather than attempting to suppress or manipulate the webpage's JavaScript filters inside the DOM, the user pastes their password into an external CLI tool called `passkb`.

- **Keystroke Simulation**: On Linux, `passkb` utilizes a special `uinput` (`winput` in transcript) device interface. On Windows, it leverages the `SendInput` API function. - **Workflow**: The user launches the tool in a terminal, pastes their complex password into the CLI, and has a 5-second window to switch focus back to the target input field. The operating system then injects synthesized keystrokes directly into the field. - **Security & Reliability Characteristics**: Because the tool runs as an independent OS process outside the browser, it has no network access and cannot read web browsing data. It can be sandboxed or jailed according to the Unix philosophy of doing one thing. Because the web application sees genuine typing events, it cannot detect or block the input with JavaScript paste filters. - **Limitations**: The tool does not currently support macOS (help wanted) and does not target mobile platforms. From a usability standpoint, it requires running a terminal side-by-side with the browser, configuring Linux device permissions, and manually switching windows within the 5-second timer.

### Takeaways Paste-blocking JavaScript on password inputs fails to improve security and instead degrades it by discouraging password manager adoption. Even official bodies like the UK government advise service operators never to block pasting in password forms. Korchagin urges web developers to cease blocking paste operations, encourages users to employ password managers, and invites open-source contributions to extend `passkb` across platforms.