While working on my taxes in Windows Desktop turbotax Premier, I went to import brokerage info. This requires logging in to the brokerage via turbotax.
I use a password manager; this is not all that uncommon any more. I use long, fully random strings for passwords.
Turbotax apparently has decided that pasting in a password is "bad".
Even the most facile investigation of best security practices should disabuse any developer of the notion that pasting passwords presents some sort of 'threat' or 'weakness', nor does it help in entering said password accurately.
I realize no devs are likely to read this. But on the unlikely chance one might do so, please consider investigating this a little deeper. There is NO benefit to preventing pasting passwords. None.
Thank you kindly,
a grumpy old ex systems administrator
You can follow the instructions here to assist in importing the 1099 into the return.
It is a security issue to paste passwords, which is why this is disabled.
Thank you for the reply. However, my point stands. Even the most facile review of best security practices confirms that blocking pasting of passwords is not a security issue. It's a classic security MYTH that people just take at face value.
But I don't expect anything to change. Old, bad, habits die hard.
I disagree.. having to retype complex secure passwords is less secure than copying from my password manager that deletes the password from the clipboard shortly after I copy it in. Please fix this or allow me to get the CSV file myself and import it.
this is nuts!
If you are referencing a CSV file for digital assets, please see the Help Article here on how to obtain this.
It is a bad and obsolete "security issue"! But I would expect nothing else from this archaic software.
Same issue for me. My passwords for all my financial institutions are complex 12+ character passwords using every character on the keyboard - generated by LastPass. TurboTax will not allow me to copy/paste these complex passwords from LastPass into the TT download form. Due to the complexity of the password, this is a slow process and mistakes are easy to make. This is the most annoying aspect of my annual tax prep task.
I would love for TT to allow copy/paste of passwords. Not clear why Intuit thinks this is a bad thing to do.
User of TurboTax desktop for 20+ years. Currently using Windows 11 Pro - insider beta version.
As a suggestion to developers, why not allow the user to make the decision about security. If it is technically unfeasible to have a non-display field as a user selected option capable of accepting a pasted password, just give the user a warning that the pasted password could be viewed by others who could see the display and ask "are you sure?". If I reply YES, then allow the paste.
Fair warning. If this feature is NOT in the next year's product I will be investigating other solutions for my tax prep.
I agree. Intuit you are wasting our time. While there is a time cost to switch to another solution, in the long run I will save time by being able to paste passwords. And not having to come to the forums to complain about it.
The inability to paste passwords and secrets is not only frustrating from a user experience perspective but runs counter to recommended security practices. See for example NIST SP 800-63B: "Verifiers SHOULD permit claimants to use “paste” functionality when entering a memorized secret. This facilitates the use of password managers, which are widely used and in many cases increase the likelihood that users will choose stronger memorized secrets."
This limitation makes the import process almost unusable. Not only do many of us use long generated passwords that are not easily entered, but many imports also require application-specific passwords that are long random keys. Typing these is impractical.
Please don't impose arbitrary limitations. And if you are going to hide behind claims of security, have a basis for such assertions.
For those looking for a solution to this limitation, you can use the Keyboard Manager in Microsoft PowerToys
to map a key combination to the text you want to paste, and it will successfully paste a character at a time into the fields that TurboTax blocks from normal paste functions. See example (not a real password) below where the Windows-Shift-P will paste the password. It is reasonably quick to paste the passwords required in the same shortcut for each import.
Thank you for linking to the NIST document. Note that this is only a problem for the local app product; Copy/Paste is allowed on the online version. My guess is that the PC code is so old and crufty that they are afraid to touch it, and the cost of getting it wrong is pretty high. I think they have decided that it is worth to Intuit to allow a little egg on their face(s).
(BTW, Intuit, this is more of a problem than you realize. "Say that you don't know much about security while saying the exact opposite.")
you are incorrect about pasting passwords being unsecure! Modern password standards and NIST do not agree with you either (https://pages.nist.gov/800-63-3/sp800-63b.html)
Additionally you can't see what you are typing! Why obscure that?? If I am doing my taxes I am in a secure place!
Do your research and talk to experts please. (real experts, Steve Gibson from GRC would be a great place to start)
Here we go again. I imported my first 1099-DIV, and TurboTax STILL doesn't allow copy+paste of passcodes!
I don't re-use passcodes, ever. Plus all of my passcodes are randomly-generated 20-digit strings. This is extremely frustrating! Please allow copy+paste passwords into TurboTax! Include a disclaimer, we're all adults!
I get notified of updates to this thread (even thought I no longer use TurboTax) because I ran into this issue years ago and posted to this forum).
I can't believe that Intuit has still not addressed this artificial limitation. I think that some developer believed that they were improving security, when in fact they weaked it.
For this reason, I switched to HR Block 3 years ago. It's cheaper, does the job just as well, and lets me paste my complex passwords.
Here's a good one! TurboTax (desktop) asked me to login this morning so I can import some banking transactions. Intuit ALLOWED me to COPY / PASTE my username and password INTO THE PROGRAM! To me, that seems like a inconsistent and somewhat hypocritical stance about disallowing copy/paste for financial institution imports.
No, this is not a security issue. This highly discourages the use of randomly-generated passwords and secure password managers. Please, at the minimum, forward this feedback with this information to the developer team.
I found a solution!
Copy your complex password into the Clipboard using the familiar CTRL-C. However, you should copy from the clipboard into TurboTax using Win-V (instead of the familiar CTRL-V). This works!!!
I am using Windows 11, but as I recall the Win-V option works in Windows 10 also. Further, this allows you to copy multiple items into the Clipboard, and when you enter Win-V it will give you a list of the items in the Clipboard, and you select which one to paste.
I did not come up with this, I saw this suggestion in a different forum where someone was having the same problem.
What's really dumb is that the vulnerability for the clipboard hijack is in the "copying." Once it's in the clipboard, it's vulnerable. People are going to copy before they figure out they can't paste. So the whole point of preventing the pasting is mostly pointless.