1

On websites that separate the screens where username and password are entered, such as GMail, it is possible that the users type the password in the username field because the username is sometimes suggested automatically based on the browsing history.

In that situation, what are the risks if the user types (and press Enter) their password in the username field?

marked as duplicate by Xander, MechMK1, PwdRsch, Tobi Nary, Ghedipunk Jul 3 at 19:56

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

7

The greatest risk is if the site logs login attempts based on the username that a user enters, rather than the account. Your password will then be displayed in cleartext in the logs, which may be leaked at some future time.

In most cases, nothing risky will happen. The site already has access to your cleartext password while you're logging on, whether they store it securely or not, so sending your password to that site in a different form field wouldn't have consequences, unless other users can see what you've entered into that field.

The normal best practices apply, of course: Never reuse your password across different sites. The site owner might be malicious, and even large, trustworthy, highly audited multinational companies will leak customer data at alarming rates. Your information has already been leaked.

This way, if you don't reuse any passwords, and use a password manager to generate truly random, unique passwords for each site, when you suspect that a password might leak, such as being logged when it shouldn't after you put it into the wrong form field, then you can update the password once on that site only, and your risks will be mitigated.

Not the answer you're looking for? Browse other questions tagged or ask your own question.