In my company we were writing a small web application which would be hosted and tested under HSTS protocol.
One of my tester complained that the username and password can be seen in cleartext so it is insecure. I replied that due to HSTS implementation it cant be decrypted. I pointed out
wireshark logs and proved that it is encrypted.
My tester pointed out
Firebug of his own browser and said that it is displaying cleartext username and password so it is insecure.
From the above, here are my analysis and questions:
Since HSTS enables security when the data moves from browser to web sever,
Firebugis just a browser plugin, it knows everything in the DOM tree so it can view forms fields, usernames and passwords.
Is it possible to disable
Firebugfrom identifying dom tree?
Does revealing the content from
Firebugis really a vulnerability? If yes how can I mitigate it?
his own browser. It has access to everything, which is normal. It is as much a vunerability as the keyboard or the user are. Both know the password at some point.
<input type=password>if not "obscured for security reasons"?