3 ms·
If the site is non-SSL, then there's nothing stopping somebody in control of the network from replacing all "password" fields with plain "text" fields, and then
by mike-cardwell 8y ago
If the site is non-SSL, then there's nothing stopping somebody in control of the network from replacing all "password" fields with plain "text" fields, and then applying a custom font to them so every character entered is displayed as a "•"
- rjmunro 8y agoThat's basically what a password field already is. That would make no difference to anything - the password would be sent over the network in exactly the same way either way.
- michaelt 8y agoRight, but some browsers display a small warning message when you select a password field on a non-https page [1] If instead of a password field it's a text field with a custom font, no such warning will be presented. [1] https://blog.mozilla.org/security/2017/01/20/communicating-the-dangers-of-non-secure-http/ https://blog.mozilla.org/security/2017/01/20/communicating-t... http://http-password.badssl.com/ http://http-password.badssl.com/
- mike-cardwell 8y agoNo. The point of switching out a password field for a text field is to prevent the browser from warning about the existence of a password field on a non-HTTPs secured page. This is a well known, and old trick.