Latest update broke password manager support

[user41095]

Hey there,

The latest Aususwrt update has broken the router login interface. I am unable to use password manager keepass to handle any logins. Furthermore it is impossible to copy and paste into the password field and when your password looks like 9oafvvucxW38Y3xUrnPH this becomes annoying.

Please revert to previous login window. This attempt at security creates a vulnerability.

 

[Martineau]

Hey there,

The latest Aususwrt update has broken the router login interface. I am unable to use password manager keepass to handle any logins. Furthermore it is impossible to copy and paste into the password field and when your password looks like 9oafvvucxW38Y3xUrnPH this becomes annoying.

Please revert to previous login window. This attempt at security creates a vulnerability.

The copy'n'paste issue is already known.....and discussed in several threads:

http://www.snbforums.com/threads/bu...rd-on-login-page-in-378-55.26058/#post-194272

P.S. Pretty bold statement by you, i.e. not sure how this move to a token based authentication method 'creates a vulnerability'?

Several posts also indicate keepass does work - search the forum

e.g. enable a keepass feature

http://www.snbforums.com/threads/asuswrt-merlin-378-55-is-now-available.25874/page-14#post-194790

 

[user41095]

I did some poking around, the problem is caused by "onpaste="return false;" noscript"

The solution, for Firefox, is to use "disable clipboard manipulations" addon - https://addons.mozilla.org/en-US/firefox/addon/nocopypaste/

P.S. Pretty bold statement by you, i.e. not sure how this move to a token based authentication method 'creates a vulnerability'?

Without the workaround the issue may drive the user to create a simpler, easier to remember, password. It causes the user to type out the password manually, this makes it susceptible to keyloggers. It causes the user to view the password, if retyping it from a database, which makes it visible to anyone looking over the shoulder or through a remote connection.

 

[reerden]

Like suggested, use the auto type feature of Keepass. Its even safer than copy paste anyway.

I believe Merlin already said that he might remove the onpaste restriction in the next release.

 

[GregS]

+1 for removing the paste restriction

 

[MarioCaires]

Nice article regarding this "issue":

http://www.wired.com/2015/07/websites-please-stop-blocking-password-managers-2015/