1

I found a website that uses the plain text field as a password input form.

<input type = "text" autocomplete= off ...>

I understand shoulder surfing is one vulnerability but are there other vulnerabilities that makes input type="password" a safer option?

7

Beyond shoulder surfing the browser can insecurely cache data. It may save input fields in an insecure manner, for auto-fill purposes. This means passwords may be tab completed, easily retrieved as plain text, and copy/pasted.

2

In addition to the other answers, phones using a keyboard with 'next word' suggestion shortcuts will learn from your entry into text fields, but typically not password fields. If you have a password of common English words, it is very plausible that a phone will offer up the next word in your password if you type it, and have previously typed your password into a text field.

Only a serious issue if your phone is compromised or the database of your word predictions are compromised or shared insecurely (such as in a heuristic learning program that shares your phrases with the keyboard vendor for better learning)

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.