2

I know that if I type a password in the username text box and hit enter it is better to change the password just in case. But is it still risky to have written it in the box (with no one watching) without having hit the "log-in" button? Could it be a problem if this happened using public WIFI?

Improve this question
3
  • 1
    For public wifi the risk isn't any different than typing it in the password box... it's possible that the page uses javascript to post that data, but this is unlikely for login fields. The browser's history will probably not save that info, but it's good to be aware that a back button will sometimes reveal username/password. (If someone else accesses your computer.)
    – pcalkins
    Feb 25, 2020 at 18:57
  • @pcalkins Post + No HTTPS + Public Wi-Fi would be bad. Also, I wouldn't be surprised if some websites did post even that data. Most of the web is data-greedy, doesn't respect user privacy, and client-side JS tends to get developed without minding the security implications. (Not arguing that it's likely. I don't have data on that. I've seen scarier things from the web, though, which qualify as business as usual.)
    – Future Security
    Feb 25, 2020 at 20:13
  • A programmer might post usernames as part of the process of fetching salts for client-side hashing. (Hopefully that doesn't allow user enumeration.) If someone were to implement that, then the should only post the user name when the form is submitted, but maybe the web developer got sloppy. Something like that could be a non-issue if you have HTTPS. (Hopefully it's not logged or sent to 3rd parties.) If the text entered on a website isn't something you want the site to know, then maybe assume the worst: That they log all keystrokes, clicks, and pastes.
    – Future Security
    Feb 25, 2020 at 20:21

1 Answer 1

Reset to default
3

I'm a frontend developer and have made many forms over the years. First, some baseline info:

  • Form data is not generally saved or processed unless its physically submitted. This is also a browser default for security of the user.
  • Form data is not even entered into any browser cache unless submitted.

However, the default behavior can be changed by the developer of the website using JavaScript. This could include posting the data in the user name field to their backend as you're typing the data without submitting it.

To check this you can open up your browser's developer tools console and check the network tab. With it open, type in the username field. Then leave it for a minute to see if there's any polling to the server happening. If any JS is firing off data to any backend you will see this as requests stacking up in the Network tab.

Another possible way your information could be compromised by typing your password into your username field could be session recording services. If the website employs one of these services (such as FullStory, Matomo, etc.) then it's possible your input was recorded and can be reviewed by someone later. You can peruse their JavaScript libraries and identify each script and what it does.

Doing the above steps should give you some piece of mind as to the safety of your password. Especially if it's not easily changeable.

Bottom Line

If it's a trivial task to update your password, you may as well do it out of an abundance of caution. It would probably end up being easier than to go through all the investigation steps I mentioned above.

Improve this answer
3
  • Okay. The website I used is a very reputable one (from a stock exchange listed company). Do you think there could be a reason for such a company to use JavaScript to gather this unsubmitted data?
    – Jan Charles Butter
    Feb 26, 2020 at 17:39
  • 1
    @JanCharlesButter I can think of many reasons large companies would use these. Maybe not specifically to gather unsubmitted data but it could be inadvertently collected. For example, HomeDepot uses Clicktale on their site which does provide session replay tools. If you check out the FullStory (another session recording service) security overview and scroll to Application Security you'll find that its up to the customer to exclude form fields.
    – gillytech
    Feb 27, 2020 at 5:41
  • I think it's pretty common for large companies to collect every gesture, click and keystroke, often using a 3rd party tool or company. It's used to predict user behavior, gather metrics on "usability", do A/B tests, etc... they may even store lists of passwords just to gather data on passwords in general. Your password choice might even say something about who you (the customer) are. (Though I think that's pretty unlikely as it's obviously a security risk to expose pwds to a 3rd party)
    – pcalkins
    Mar 2, 2020 at 21:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .