6 ms·

Does anybody else think unmasking the password field is a terrible idea?

Xurinos 15y ago
No. It is something of a sham. It protects you from one use case: people watching the screen over your shoulder. It does not guard against people watching your fingers on the keyboard. It does provide a sense of security. I have no problem shielding the password with a hand over the screen, clicking the box, checking, and unclicking.
- count 15y ago
  It also prevents copy/pasting out of that field by most browsers. If someone gets access to your computer because you walked away for a second, goes to your bank page and it autofills, they can access the site, but they can't know your password (which is generally shared between many sites), and so they can only do damage there locally for a (hopefully) brief period of time. If it just displayed in a textbox, game over...
  - Xurinos 15y ago
    Sure, copy-paste, but if you monitor the outgoing query via Firebug, you can get the raw password. (This is confirmed with the gmail password input.) I have also in the past used various Windows tools for finding the value of a text box or for toggling the hiddenness of the text. Basically, if someone has access to the machine where your password is stored in any form, all bets are off.
g_lined 15y ago
A lot of the time I use a computer outside of work, I am alone in a house into which no one can see or I am alone in a house with my partner with whom I share all of my passwords. As such, I'd rather have the option of unmasking my password because it makes things easier for me. I use long passwords and so it's not rare (though neither common) for me to type it wrong so I end up typing my 'password' 4 or 6 times.
- jtheory 15y ago
  There are probably purpose-built plugins to show passwords, but you can also use the very popular Web Developer plugin if you use Firefox -- to make password fields visible, in the context menu hit: > Web Developer > Forms > Show Passwords You can also type your password into the username field first, then cut & paste it into the password field before entering your actual username. Some years back while traveling and using dubious internet cafes I used to (I imagined) defeat keyloggers and at the same time navigate foreign keyboard layouts by typing my password mixed-up into the username field, then copy/pasting it a piece at a time into the correct order in the password field.
mekoka 15y ago
I think it depends of the sensitivity of the material in the website. e.g. I would never do this for a financial service website, just in case I get sued later. If your website doesn't require https for logins, then unmasking the password at registration time is the least of your worries. It should nonetheless be noted that many browsers cache values entered in non-password fields, so if someone is using a shared computer to register, the next person might only have to double-click on the non-hidden password field to see a list of previously entered passwords. Not so good.
- mooism2 15y ago
  Does the value in a field that gets toggled between password and plaintext get cached when the field is a password at the time the form is submitted? We could always ensure the field was in password mode at that instant.
- balac 15y ago
  The same can be said for credit card information, thats why autocomplete="off" exists.
blasdel 15y ago
It's terrible in the biggest way you can fuck up your UI: doing the opposite of what every user expects Billions of people are all used to typing into masked (or unechoed) password fields, having done so in a wide range of UIs a shitload of times. Typing into a password field and seeing it reflected back feels like a slap in the face, the security context is irrelevant, it's just a massive discourtesy. Your website is not going to be the very first thing the user has ever logged into. It is not your place to try to reinvent such fundamental things, changing this on your site is on the same level of jackass hubris as reversing the tab order or mouse coordinate system with javascript. All you're going to do is infuriate people.

No. It is something of a sham. It protects you from one use case: people watching the screen over your shoulder. It does not guard against people watching your fingers on the keyboard. It does provide a sense of security. I have no problem shielding the password with a hand over the screen, clicking the box, checking, and unclicking.

count 15y ago
It also prevents copy/pasting out of that field by most browsers. If someone gets access to your computer because you walked away for a second, goes to your bank page and it autofills, they can access the site, but they can't know your password (which is generally shared between many sites), and so they can only do damage there locally for a (hopefully) brief period of time. If it just displayed in a textbox, game over...
- Xurinos 15y ago
  Sure, copy-paste, but if you monitor the outgoing query via Firebug, you can get the raw password. (This is confirmed with the gmail password input.) I have also in the past used various Windows tools for finding the value of a text box or for toggling the hiddenness of the text. Basically, if someone has access to the machine where your password is stored in any form, all bets are off.

g_lined 15y ago

A lot of the time I use a computer outside of work, I am alone in a house into which no one can see or I am alone in a house with my partner with whom I share all of my passwords. As such, I'd rather have the option of unmasking my password because it makes things easier for me. I use long passwords and so it's not rare (though neither common) for me to type it wrong so I end up typing my 'password' 4 or 6 times.

jtheory 15y ago
There are probably purpose-built plugins to show passwords, but you can also use the very popular Web Developer plugin if you use Firefox -- to make password fields visible, in the context menu hit: > Web Developer > Forms > Show Passwords You can also type your password into the username field first, then cut & paste it into the password field before entering your actual username. Some years back while traveling and using dubious internet cafes I used to (I imagined) defeat keyloggers and at the same time navigate foreign keyboard layouts by typing my password mixed-up into the username field, then copy/pasting it a piece at a time into the correct order in the password field.

mekoka 15y ago

I think it depends of the sensitivity of the material in the website. e.g. I would never do this for a financial service website, just in case I get sued later. If your website doesn't require https for logins, then unmasking the password at registration time is the least of your worries. It should nonetheless be noted that many browsers cache values entered in non-password fields, so if someone is using a shared computer to register, the next person might only have to double-click on the non-hidden password field to see a list of previously entered passwords. Not so good.

mooism2 15y ago
Does the value in a field that gets toggled between password and plaintext get cached when the field is a password at the time the form is submitted? We could always ensure the field was in password mode at that instant.
balac 15y ago
The same can be said for credit card information, thats why autocomplete="off" exists.

blasdel 15y ago

It's terrible in the biggest way you can fuck up your UI: doing the opposite of what every user expects Billions of people are all used to typing into masked (or unechoed) password fields, having done so in a wide range of UIs a shitload of times. Typing into a password field and seeing it reflected back feels like a slap in the face, the security context is irrelevant, it's just a massive discourtesy. Your website is not going to be the very first thing the user has ever logged into. It is not your place to try to reinvent such fundamental things, changing this on your site is on the same level of jackass hubris as reversing the tab order or mouse coordinate system with javascript. All you're going to do is infuriate people.