For example, suppose I already typed username and password at this Facebook page:
But I wrongly clicked 'Create New Account' instead of Log In. My question is, does it increase any security risk?
I admit this question seemed like it had a straightforward answer at first but then after looking into Facebook's page and the button functionality it definitely does beg the question.
I discovered that if you have the username/password fields filled in with the credentials of a legitimate account, or have auto-fill username/password in place pulling from either Chrome itself or a password manager- which may/may not be a good practice depending on your level of security paranoia- then selecting the 'Create New Account' button actually does send a POST message that includes details of your login information from the previous page, including username/password. If you're curious and aren't already aware, this can be done by simply monitoring the network requests in your browser.
Despite this, I would still say that it depends on the application you are interacting with. In this case, since it's Facebook and- though this may be a point of contention within the community- we can trust Facebook with our data, then as long as the POST request that had my username/password information in its payload was made over secure transmission I can presume to be unworried about a security risk. I would only imagine that at this point the information being sent to Facebook via this POST request would need to be equally as secure as the login button itself.
I have never encountered another site that does this, but am hoping to see other answers on this based on other experiences.
The action your performing is no more risk than clicking login button.
The data will only be stored client side as your not performing an POST HTTP request for that form.
My Request body when clicking sign up with username and password as "fake"
So, I put some garbage information in there:
From the above POST request there is no mention of the word "fake"
This time I typed in username and password as "test" and clicked login:
Finally, I've set auto-complete on and done the sign up, same behaviour. No mention of username or password been sent off to the server.
Let's even assume for one moment that the username and password was sent off to the server. You're risk would be same as clicking login anyway so your standard attacks like MITM and XSS apply.
I've tested this on Chrome Version 67.0.3396.99 (Official Build) (64-bit) and only extension I have installed is Tamper Data for Chrome.
Unless the page designer was truely schizophrenic, there should be no increased security risk. A HTML form consists of:
If you do not click on one of the submit buttons of the form, the input fields should not be member of the request. So if you click to a link, no data will not be added to the link url, and is you click on a submit button of a different form, only the data of that other form will be sent.
(*) a not too cautious programmer could send the credentials to a wrong page but still on the same site or inside the same security zone. So I cannot imagine a data leak here. And if the site is poor enough to store the password in an unencrypted form on that other page, you cannot trust it to correctly handle your password in any other place including when you click on the correct button.