While hunting for bugs, I landed on a website which shows my password in plain-text when I inspect element when I sign in (I didn't tweak things like changing type attribute to text). I can clearly see my password which I just typed without doing anything.

How can I show its impact to the company? How can a attacker abuse this flaw?

  • 1
    Do you mean that on the website the login form doesn't replace your password with asterisks? Or is the password shown in the site source code after you log in?
    – Gillian
    Jun 15 '18 at 19:40
  • asterisks are obviously there but after typing password I can clearly see it through inspect element in plaint-text. And am not doing anything like changing type attribute to text in inspect element. I can see the password in plain-text in the code.
    – Akash
    Jun 15 '18 at 19:43
  • 5
    As @Gillian says in his answer, the behavior is completely normal, and also completely necessary for browsers to work. Your password really MUST be stored somewhere when you type it into the browser. The asterisks are present only to prevent "shoulder surfing", and don't represent that the password isn't present in the browser. Jun 15 '18 at 20:41
  • @SteveSether What I think is password is not actually presented in the browser in "plain text" it maybe somehow encrypted. I don't know how its presented but its sent over POST requests "afterwards" (we can even see this one in plain text by intercepting the traffic)
    – Akash
    Jun 15 '18 at 22:38
  • 2
    @Akash This is not how browsers work. Jun 16 '18 at 1:36

The attacker can't abuse this flaw any more than what he can do already without the flaw.

You probably have an impression that websites (and web browsers) which don't allow you to see the actual password in the HTML are protected against an attacker who would get ahold of your computer during filling in the login form. This is not true since:

  1. I can use web inspector tool to sometimes extract the password directly (as you can in your case)
  2. I can use the javascript console to extract the password with DOM access methods
  3. I can use the network monitor in the web inspector tool, submit the form and analyze the request parameters to extract your password

So it can hardly be considered a flaw.

  • There was an issue with redux-form which would fit OP's description: github.com/erikras/redux-form/issues/2417
    – Gillian
    Jun 15 '18 at 20:54
  • 2
    @Gillian Fascinating. I'm not sure what to think of that thread, and why some people think this is "a problem". Maybe the fact that the password is actually there (just hidden) disturbs their sense of how it works.. To account for this people think it must be a flaw in the security, and not a flaw in their mental model. (Many people don't like having their views disturbed, so make up an imaginary belief to cover) Jun 16 '18 at 1:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.