Let them paste passwords
> Justification 1: 'Password pasting allows brute force attacks'<p>This really pisses me off every time I see it.<p>JavaScript is client-side code. If the attacker you're protecting against can't trivially bypass this bullshit "security" feature in three seconds, then he/she is not something you should be concerned about.<p>Attackers like that probably have other skills like counting to 5 with a 60% accuracy, and pointing out their own nose with a 40% accuracy. (Just like you do if you have this on your website.)