3 ms·

Am I the only person that doesn't want passwords echoed to the screen, to any extent, ever? If I have to do a password confirmation I'd rather submit a form an

by erso 17y ago

Am I the only person that doesn't want passwords echoed to the screen, to any extent, ever? If I have to do a password confirmation I'd rather submit a form and have it tell me my passwords didn't match than to have immediate feedback with a visualization that isn't accessible.

tptacek 17y ago
No. These password visualizers are startlingly unsafe and largely useless responses to what is mostly a non-problem.
- jrockway 17y ago
  How are they startling unsafe? If you watch someone type their password, you can get a visual cue that you retyped it correctly without submitting it to the server? For me, this is like syntax highlighting. It is not necessary, but it's nice to have that colored visual cue so that your brain quickly knows that you got it right.
  - tptacek 17y ago
    When you watch someone type their password into a PASSWORD input field, the only feedback you get is a dot on the screen. When you watch someone type their password into one of these password-visualizing fields, you get a visualization of an hash of however many characters they've entered. If you have any ability to capture that hash, you can dictionary the password to a set of candidates. If the person hesitates typing just long enough to get an interim visualization, you can probably narrow it down to a hand-guessable subset of passwords. This isn't a reasonable security concession for the value of eliminating a server roundtrip to confirm a password, especially given the fact that less than 2% of your user base will ever use the visualization, but 100% of your user base is exposed to the liability.
    - jrockway 17y ago
      This is a greasemonkey script that the user chooses to use himself.
      - tptacek 17y ago
        No, it's a jQuery extension that has (among other things) been ported to Greasemonkey. What you do with your browser is your business; it's still a bad idea --- if you can do visualization with Greasemonkey, you can also do a password manager --- but if it's not in the actual web application, who cares?
    - calcnerd256 17y ago
      I didn't look into how it works on the backend, but fetching the images means all the intermediate hashes are being sent out, right?
      - tptacek 17y ago
        No, it's not fetching images for each of the hashes; it's a pure-JS MD5 which selects CSS background-colors for DOM elements.

by erso 17y ago

tptacek 17y ago

No. These password visualizers are startlingly unsafe and largely useless responses to what is mostly a non-problem.

jrockway 17y ago
How are they startling unsafe? If you watch someone type their password, you can get a visual cue that you retyped it correctly without submitting it to the server? For me, this is like syntax highlighting. It is not necessary, but it's nice to have that colored visual cue so that your brain quickly knows that you got it right.
- tptacek 17y ago
  When you watch someone type their password into a PASSWORD input field, the only feedback you get is a dot on the screen. When you watch someone type their password into one of these password-visualizing fields, you get a visualization of an hash of however many characters they've entered. If you have any ability to capture that hash, you can dictionary the password to a set of candidates. If the person hesitates typing just long enough to get an interim visualization, you can probably narrow it down to a hand-guessable subset of passwords. This isn't a reasonable security concession for the value of eliminating a server roundtrip to confirm a password, especially given the fact that less than 2% of your user base will ever use the visualization, but 100% of your user base is exposed to the liability.
  - jrockway 17y ago
    This is a greasemonkey script that the user chooses to use himself.
    - tptacek 17y ago
      No, it's a jQuery extension that has (among other things) been ported to Greasemonkey. What you do with your browser is your business; it's still a bad idea --- if you can do visualization with Greasemonkey, you can also do a password manager --- but if it's not in the actual web application, who cares?
  - calcnerd256 17y ago
    I didn't look into how it works on the backend, but fetching the images means all the intermediate hashes are being sent out, right?
    - tptacek 17y ago
      No, it's not fetching images for each of the hashes; it's a pure-JS MD5 which selects CSS background-colors for DOM elements.