Pasting passwords blocked

[anastrophe]

While working on my taxes in Windows Desktop turbotax Premier, I went to import brokerage info. This requires logging in to the brokerage via turbotax.

I use a password manager; this is not all that uncommon any more. I use long, fully random strings for passwords.

Turbotax apparently has decided that pasting in a password is "bad".

Even the most facile investigation of best security practices should disabuse any developer of the notion that pasting passwords presents some sort of 'threat' or 'weakness', nor does it help in entering said password accurately.

I realize no devs are likely to read this. But on the unlikely chance one might do so, please consider investigating this a little deeper. There is NO benefit to preventing pasting passwords. None.

Thank you kindly,

a grumpy old ex systems administrator

[CarissaM]

You can follow the instructions here to assist in importing the 1099 into the return. 

It is a security issue to paste passwords, which is why this is disabled. 

[anastrophe]

Thank you for the reply. However, my point stands. Even the most facile review of best security practices confirms that blocking pasting of passwords is not a security issue. It's a classic security MYTH that people just take at face value.

But I don't expect anything to change. Old, bad, habits die hard.

[jbdavid77]

I disagree.. having to retype complex secure passwords is less secure than copying from my password manager that deletes the password from the clipboard shortly after I copy it in.   Please fix this or allow me to get the CSV file myself and import it. 

this is nuts!

[HeatherPLO]

If you are referencing a CSV file for digital assets, please see the Help Article here on how to obtain this.  

@jbdavid77 

[AnnoyedSD]

It is a bad and obsolete "security issue"! But I would expect nothing else from this archaic software.

[cosnerr]

Same issue for me.  My passwords for all my financial institutions are complex 12+ character passwords using every character on the keyboard - generated by LastPass.  TurboTax will not allow me to copy/paste these complex passwords from LastPass into the TT download form.  Due to the complexity of the password, this is a slow process and mistakes are easy to make.  This is the most annoying aspect of my annual tax prep task.

I would love for TT to allow copy/paste of passwords.  Not clear why Intuit thinks this is a bad thing to do.

User of TurboTax desktop for 20+ years.  Currently using Windows 11 Pro - insider beta version.

[jcrandle]

As a suggestion to developers, why not allow the user to make the decision about security. If it is technically unfeasible to have a non-display  field as a user selected option capable of accepting a pasted password, just give the user a warning that the pasted password could be viewed by others who could see the display and ask "are you sure?".  If I reply YES, then allow the paste.

Fair warning. If this feature is NOT in the next year's product I will be investigating other solutions for my tax prep.

[Kipernicus]

I agree. Intuit you are wasting our time. While there is a time cost to switch to another solution, in the long run I will save time by being able to paste passwords. And not having to come to the forums to complain about it.

[BakerStreetMuse]

The inability to paste passwords and secrets is not only frustrating from a user experience perspective but runs counter to recommended security practices.  See for example NIST SP 800-63B: "Verifiers SHOULD permit claimants to use “paste” functionality when entering a memorized secret. This facilitates the use of password managers, which are widely used and in many cases increase the likelihood that users will choose stronger memorized secrets."

This limitation makes the import process almost unusable.  Not only do many of us use long generated passwords that are not easily entered, but many imports also require application-specific passwords that are long random keys.  Typing these is impractical.

Please don't impose arbitrary limitations. And if you are going to hide behind claims of security, have a basis for such assertions.

[BakerStreetMuse]

For those looking for a solution to this limitation, you can use the Keyboard Manager in Microsoft PowerToys 

to map a key combination to the text you want to paste, and it will successfully paste a character at a time into the fields that TurboTax blocks from normal paste functions.  See example (not a real password) below where the Windows-Shift-P will paste the password.  It is reasonably quick to paste the passwords required in the same shortcut for each import.

[knechod]

Thank you for linking to the NIST document.  Note that this is only a problem for the local app product; Copy/Paste is allowed on the online version.  My guess is that the PC code is so old and crufty that they are afraid to touch it, and the cost of getting it wrong is pretty high.  I think they have decided that it is worth to Intuit to allow a little egg on their face(s).

(BTW, Intuit, this is more of a problem than you realize. "Say that you don't know much about security while saying the exact opposite.")

[flyaway]

you are incorrect about pasting passwords being unsecure!  Modern password standards and NIST do not agree with you either (https://pages.nist.gov/800-63-3/sp800-63b.html)

Additionally you can't see what you are typing!  Why obscure that??  If I am doing my taxes I am in a secure place!

Do your research and talk to experts please.  (real experts, Steve Gibson from GRC would be a great place to start)

[davidfigueroa]

thank you!