Pasting passwords blocked

Forum|Forum|3 years ago
February 14, 2023
4 replies
0 views

While working on my taxes in Windows Desktop turbotax Premier, I went to import brokerage info. This requires logging in to the brokerage via turbotax.

I use a password manager; this is not all that uncommon any more. I use long, fully random strings for passwords.

Turbotax apparently has decided that pasting in a password is "bad".

Even the most facile investigation of best security practices should disabuse any developer of the notion that pasting passwords presents some sort of 'threat' or 'weakness', nor does it help in entering said password accurately.

I realize no devs are likely to read this. But on the unlikely chance one might do so, please consider investigating this a little deeper. There is NO benefit to preventing pasting passwords. None.

Thank you kindly,

a grumpy old ex systems administrator

CarissaM

You can follow the instructions here to assist in importing the 1099 into the return.

It is a security issue to paste passwords, which is why this is disabled.

**Say "Thanks" by clicking the thumb icon in a post**Mark the post that answers your question by clicking on "Mark as Best Answer"

anastropheAuthor

Thank you for the reply. However, my point stands. Even the most facile review of best security practices confirms that blocking pasting of passwords is not a security issue. It's a classic security MYTH that people just take at face value.

But I don't expect anything to change. Old, bad, habits die hard.

cosnerr

Same issue for me. My passwords for all my financial institutions are complex 12+ character passwords using every character on the keyboard - generated by LastPass. TurboTax will not allow me to copy/paste these complex passwords from LastPass into the TT download form. Due to the complexity of the password, this is a slow process and mistakes are easy to make. This is the most annoying aspect of my annual tax prep task.

I would love for TT to allow copy/paste of passwords. Not clear why Intuit thinks this is a bad thing to do.

User of TurboTax desktop for 20+ years. Currently using Windows 11 Pro - insider beta version.

BakerStreetMuse

The inability to paste passwords and secrets is not only frustrating from a user experience perspective but runs counter to recommended security practices. See for example NIST SP 800-63B: "Verifiers SHOULD permit claimants to use “paste” functionality when entering a memorized secret. This facilitates the use of password managers, which are widely used and in many cases increase the likelihood that users will choose stronger memorized secrets."

This limitation makes the import process almost unusable. Not only do many of us use long generated passwords that are not easily entered, but many imports also require application-specific passwords that are long random keys. Typing these is impractical.

Please don't impose arbitrary limitations. And if you are going to hide behind claims of security, have a basis for such assertions.

BakerStreetMuse

For those looking for a solution to this limitation, you can use the Keyboard Manager in Microsoft PowerToys

to map a key combination to the text you want to paste, and it will successfully paste a character at a time into the fields that TurboTax blocks from normal paste functions. See example (not a real password) below where the Windows-Shift-P will paste the password. It is reasonably quick to paste the passwords required in the same shortcut for each import.

davidfigueroa

thank you!

deanord

I get notified of updates to this thread (even thought I no longer use TurboTax) because I ran into this issue years ago and posted to this forum).

I can't believe that Intuit has still not addressed this artificial limitation. I think that some developer believed that they were improving security, when in fact they weaked it.

For this reason, I switched to HR Block 3 years ago. It's cheaper, does the job just as well, and lets me paste my complex passwords.