Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

This question already has an answer here:

I've noticed that on a lot of login forms in websites and applications that there is a "show password" check box. Why? I myself have seen some hacks that an attacker could hack the input password box. Doesn't enabling the "show password" box constitute as a security risk?

share|improve this question

marked as duplicate by Terry Chia, Adnan, symcbean, Scott Pack, AviD Dec 23 '13 at 15:43

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

    
I myself have seen some hacks that an attacker could hack the input password box. Could you expand on this? –  Abe Miessler Dec 23 '13 at 18:10
    
@AbeMiessler, Someone showed me once, how he 'hacked' the password box. But later on he explained that it was just with Firebug(forgot how he hacked it). he changed the type="password" to type="text". Nothing special –  blade19899 Dec 23 '13 at 19:36
    
@AbeMiessler, here is a howto. He's using Chrome, but still the same: totallynoob.com/… –  blade19899 Dec 23 '13 at 19:44

1 Answer 1

The 'show password' option is a feature designed for better user experience. This started getting popular with the recent rise in numbers of mobile devices. The small on screen keyboards are notoriously difficult to type with, and when you are unable to see your input it can make it difficult to be sure the password was typed correctly.

I am not sure of any attacks that target readable password fields. In my opinion, if you have malware on your computer that can see your screen, then its quite probable they are capturing your keystrokes as well.

Is it a risk? Yes. This should never be the default behavior, but if a user feels they are comfortable displaying their password (secure in their physical envirioment), then I see no problem with this practice.

This is just my opinion, not a rule.

share|improve this answer
    
Follow up question: Why not post that answer in the dupe-source question? It's clearly referenced in Terry's comment. The question will get bumped up and your answer will get your sweet upvotes. –  Adnan Dec 23 '13 at 15:41
    
I should have checked that before replying, thanks. It looks like Terry's answer is more than complete anyways. Thanks for those sweet upvotes though. –  David Houde Dec 23 '13 at 17:04

Not the answer you're looking for? Browse other questions tagged or ask your own question.