Why do some sites block paste on forms?

Question

I've noticed (as I'm sure we all have) several sites which block copy and paste.

Many questions and answers on ux.SE seem to focus on a client wanting to protect their content, but I'm specifically asking about blocking paste.

Contexts I see most often:

• A credit card form which blocks paste of card details
• A signup form asking to verify a password, blocking paste
• A signup form asking to verify an email address

It would seem this is counterintuitive even by spurious "security" logic. Has anyone been asked to implement this, and if so, what was the reasoning?

Does anyone have any data?

Answer 1

The examples you provide are quite different, so I would expect that there's different rationale behind them.

1. Pasting card details might be blocked for reasons of security. For example, it might be deemed that the clipboard could be vulnerable, thus users are discouraged to store confidential information in it (i.e. not use copy-paste). Another security argument might be that copy-pasting would mean that you have the data saved permanently somewhere else, which (unless done with the necessary precautions, such as encryption) is a risk on its own. This might address more specifically the example of credit card details that you mention. It is also true that for this particular use-case this risk could be considered minor.

2. As for the case with verification, there's another strong argument: One of the reasons verification is important is the possibility that a user mistypes at registration. This is most obvious with passwords where users don't see what they've typed. If one mistypes the intended password, one will not be able to access the service where they've just registered. Verification asks you to type it again, since the chance to mistype it twice in the same way is drastically smaller.

3. Mail is not much different than password. Imagine registering for a service which needs to send you a password-setting link upon registration. If you register with a mistyped e-mail, you will never get this link.

If you have pasting enabled, you'd be tempted to copy-paste the verification field from th original field, due to their proximity. However, this defeats the purpose of verification.

The verification mechanism is commonplace and I've implemented it in several services. In contrast, for one service we decided not to have verification via repetition, and as a consequence we have higher rate of users that register, but do not engage with the app.