25

Context

NIST SP 800-63b gives the following guidance for password forms (aka login pages):

Verifiers SHOULD permit claimants to use “paste” functionality when entering a memorized secret. This facilitates the use of password managers, which are widely used and in many cases increase the likelihood that users will choose stronger memorized secrets.

In order to assist the claimant in successfully entering a memorized secret, the verifier SHOULD offer an option to display the secret — rather than a series of dots or asterisks — until it is entered. This allows the claimant to verify their entry if they are in a location where their screen is unlikely to be observed. The verifier MAY also permit the user’s device to display individual entered characters for a short time after each character is typed to verify correct entry. This is particularly applicable on mobile devices.

Question

I had the argument made to me that these two features should not be implemented together because they would allow a user to circumvent a password manager's protection and view the auto-populated password. I suspect this argument won't hold water, but I'm curious about community opinions.

3
  • 55
    I suspect that with most (all?) password managers, if you're logged in enough that it will paste passwords, then you're also logged in enough to go view the password. Aug 25 '20 at 21:37
  • 14
    Some password managers do have options to allow certain viewers to use a password but not see it. But as you show in your answer, it's a fairly thin protection. Doesn't even make sense if you aren't using browser plug-in, because you could just paste it into Notepad. Aug 25 '20 at 21:53
  • 9
    Additionally, if someone had access to input the password but not directly read it, they could read the contents with dev tools regardless of whether it's visible normally. Aug 26 '20 at 13:18
104

Password managers are not meant to hide your passwords from yourself

It's as simple as that. To whit: most password managers let you view your own password anytime you want anyway. I say "most" only because I haven't used them all. I've worked with a few sites where auto fill doesn't work for reasons outside the password managers control. Therefore viewing/copying your own passwords is a necessity. IMO a password manager that doesn't let you view your own secrets is a broken password manager.

If you can use the password manager to view your own password, then an individual site that refuses to display a password at the user's request in an attempt to hide their password from themselves has grossly missed the bigger picture.

Some people use password managers, some don't

The ability to paste is very helpful when using password managers. The ability to view as you type is helpful for people who are typing their passwords (especially on phones). These are two different features for two different groups of people, both of whom can be expected to use a given site. Therefore to say you only need one of these features at a time is just silly...

12
  • 4
    I use a VDI environment where you cannot paste anything. And all of my passwords are managed by the password manager. If I could not see them, I would dump that manager and get a properly working one.
    – ThoriumBR
    Aug 25 '20 at 23:22
  • 1
    My password manager (LastPass, KeePass) hides the passwords from me in everyday use. It just fills them in. No need to see them, unless I explicitly want to do that. With LastPass I also need to enter the master password to see it. I like that.
    – Marcel
    Aug 26 '20 at 7:28
  • 9
    @Marcel But you can just fill the password somewhere that lets you see it, like a browser or text file, right? Does requiring a master password to see it directly add any security?
    – Mark
    Aug 26 '20 at 10:06
  • 3
    Your second question is very relevant: does requiring your master password to see it add any security? For most people probably not. Such a feature would protect you against someone sitting down at your computer when you are away and manually copying all your passwords. I doubt that is a relevant concern for most, and it's also not really the threat model that password managers are meant to protect against. Therefore, for me personally, I'd quickly get tired of having to enter my master password all the time and would find a new password manager. Aug 26 '20 at 10:13
  • 2
    @Marcel I use LastPass and the master password unlocks both using and viewing passwords at the same time. (Meaning if I get logged out then obviously I have to enter my password to use it). If I can have it fill a password then I can view the password. Maybe it depends how you've set it up?
    – Kat
    Aug 26 '20 at 13:39
30

[self-answer]

You can trivially unmask a password field with right-click > Inspect Element > change type="password" to type="". So there's really no reason not to put a "View your password" eyeball on a web UI.

Testing on GitHub's front page, which does not have the eyeball button:

Unmasking a password with Inspect Element


Unmasking a password with Inspect Element

7
  • Right. I was about to say that. The only good it does is keep non-tech-savvy users from unveiling the password, I guess? Aug 25 '20 at 21:50
  • 40
    @FireQuacker the dots are to prevent shoulder surfers, not to prevent any user from knowing their password.
    – Tim
    Aug 26 '20 at 7:10
  • 25
    Not only shoulder surfers. Consider a web conference with shared screen ...
    – pLumo
    Aug 26 '20 at 8:39
  • 2
    A password manager could prevent filling fields that are not type="password", e.g., when it has a deep browser integration, but you probably could still read the password from the developer console. The protection is to help you to prevent others from seeing your passwords and not to prevent you from seeing your own passwords, so I would not overthink it and just quickly login after the password is inserted by the password manager, so other people cannot get it when you leave your computer unlocked and unattended.
    – allo
    Aug 26 '20 at 13:17
  • 1
    Oh man, I totally had to borrow this trick recently, lol! Sep 9 '20 at 14:34
20

There are many good answers already, but I would like to add one point.

Quite frequently, I have to enter passwords on computers that I don't have my password manager installed on. When that happends, I read the password on my cell phone and enter it on the computer. This would also frequently be the case for those who uses a local password manager on just one device.

When entering random gibberish, it is very easy to get lost. Erasing everything and starting over is pain in the butt. If I didn't have the ability to view the password while typing it so I can easily correct mistakes, I would be lazy and pick much shorter passwords.

TL;RD: Allowing to view passwords while typing makes me pick better passwords, even if I am using a password manager.

12

Consider that your first quote explicitly references "paste" functionality, which implies a clipboard. As opposed to autofill that directly enters data into a webpage form.

Common clipboard implementations do not prevent the user from pasting the clipboard contents into arbitrary destinations (or, indeed, other programs from retrieving/logging clipboard contents).

If the argument is that the "eyeball" functionality may reveal passwords to the user, the user could more easily do so simply by pasting the clipboard contents into a different non-masked field.

3
  • But asinine paste-blocking JavaScript often doesn't distinguish between clipboard pastes and password-manager inserts. Aug 26 '20 at 8:51
  • 1
    Pasting the content into non-masked fields or just pasting it into a different program all together Aug 26 '20 at 8:59
  • Speaking of asinine paste-blocking JavaScript, if a site disallows pasting into the password box, then I'll echo all of the "find another password manager" comments and say "find another site". Aug 28 '20 at 19:17
8

I would say that these requirements do not compete nor are mutually exclusive.

The only thing what must made sure is, that pasting the password does not trigger the "show last character" for the entire password. Instead, when pasting, the system should make sure, that only the dots (or any other visual cue, if any at all) are visible.

So:

  • when pasting, the password is hidden completely during paste
  • when entering by keys, the last character is shown for each keystroke

As others pointed out, AFTER pasting or keying in, the entirety of the password MIGHT get inspected either by F12 or the "eye" icon.

4

In addition to the other answers: any password manager worth using uses a Master Password that needs to be entered before any passwords can be copied over. If you know that master password, the password manager allows you to see everything, even if you have to paste it in Notepad first. If you don't know that password, the password manager won't do anything with your passwords: it won't decrypt them, it won't autopopulate them, it won't allow you to paste them, it won't allow you to circumvent the protection of that master password in any way.

So if you don't know that master password, there is no way to get the passwords out of the vault (unless the password manager has a vulnerability). If you know the master password, you already have full access to the passwords in the password manager and there is no reason at all to try and circumvent security measures that aren't there.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.