1

I've come across a few sites (but not many, https://www.bankofamerica.com made me think of this) that convert the credential fields to password fields that were not masked fields (e.g. Username field) before transmitting (e.g. using javascript). What is the benefit of this?

  • By credential fields you mean ordinary text input fields? – Arminius Jan 9 '17 at 3:38
  • Yes, the username field that was not masked during focus or blur. – mlhDev Jan 9 '17 at 4:05
2

The only benefit is that, presumably, the username field is no longer clearly visible in the browser. That might help prevent shoulder surfing though it seems a stretch to me.

I can't think of any other potential benefit.

  • 1
    It might also prevent the browser saving the content if some sort of form auto fill is enabled. – iainpb Jan 9 '17 at 8:13
0

The amount of security gained from such a practice is very small. Some Linux login prompts do not display what is or how much is in a password field. For a username, not showing what characters, but how many have been entered is next to useless. In an official email they will likely give your username in the clear, and do the same thing on paper.

As mentioned in other answers, such a practice of making the username field a password field can help only with shoulder surfing. The "attacker" is still aware of how many characters your username is, and if they had access to the browser's memory, they could potentially gain access to both the username and password.

Unless the username is also hashed/encrypted/obfuscated, and you intend to do banking in a public place, this practice is much "security for show".

0

Edit There are some tools that can get screenshots and send out from the user's PC in such case screen capturing is useless as the information are in the hidden text boxes.

If there is special requirement for such thing you can go for it but remember there is mask/unmask option comes with the password textbox also for more user friendliness.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.