Password entry: are "paste from password manager" and "eyeball to view passwords" mutually-exclusive features?

Question

Context

NIST SP 800-63b gives the following guidance for password forms (aka login pages):

Verifiers SHOULD permit claimants to use “paste” functionality when entering a memorized secret. This facilitates the use of password managers, which are widely used and in many cases increase the likelihood that users will choose stronger memorized secrets.

In order to assist the claimant in successfully entering a memorized secret, the verifier SHOULD offer an option to display the secret — rather than a series of dots or asterisks — until it is entered. This allows the claimant to verify their entry if they are in a location where their screen is unlikely to be observed. The verifier MAY also permit the user’s device to display individual entered characters for a short time after each character is typed to verify correct entry. This is particularly applicable on mobile devices.

Question

I had the argument made to me that these two features should not be implemented together because they would allow a user to circumvent a password manager's protection and view the auto-populated password. I suspect this argument won't hold water, but I'm curious about community opinions.

Answer 1

Password managers are not meant to hide your passwords from yourself

It's as simple as that. To whit: most password managers let you view your own password anytime you want anyway. I say "most" only because I haven't used them all. I've worked with a few sites where auto fill doesn't work for reasons outside the password managers control. Therefore viewing/copying your own passwords is a necessity. IMO a password manager that doesn't let you view your own secrets is a broken password manager.

If you can use the password manager to view your own password, then an individual site that refuses to display a password at the user's request in an attempt to hide their password from themselves has grossly missed the bigger picture.

Some people use password managers, some don't

The ability to paste is very helpful when using password managers. The ability to view as you type is helpful for people who are typing their passwords (especially on phones). These are two different features for two different groups of people, both of whom can be expected to use a given site. Therefore to say you only need one of these features at a time is just silly...

Answer 2

[self-answer]

You can trivially unmask a password field with right-click > Inspect Element > change type="password" to type="". So there's really no reason not to put a "View your password" eyeball on a web UI.

Testing on GitHub's front page, which does not have the eyeball button:

---

Answer 3

There are many good answers already, but I would like to add one point.

Quite frequently, I have to enter passwords on computers that I don't have my password manager installed on. When that happends, I read the password on my cell phone and enter it on the computer. This would also frequently be the case for those who uses a local password manager on just one device.

When entering random gibberish, it is very easy to get lost. Erasing everything and starting over is pain in the butt. If I didn't have the ability to view the password while typing it so I can easily correct mistakes, I would be lazy and pick much shorter passwords.

TL;RD: Allowing to view passwords while typing makes me pick better passwords, even if I am using a password manager.

Answer 4

Consider that your first quote explicitly references "paste" functionality, which implies a clipboard. As opposed to autofill that directly enters data into a webpage form.

Common clipboard implementations do not prevent the user from pasting the clipboard contents into arbitrary destinations (or, indeed, other programs from retrieving/logging clipboard contents).

If the argument is that the "eyeball" functionality may reveal passwords to the user, the user could more easily do so simply by pasting the clipboard contents into a different non-masked field.

Answer 5

I would say that these requirements do not compete nor are mutually exclusive.

The only thing what must made sure is, that pasting the password does not trigger the "show last character" for the entire password. Instead, when pasting, the system should make sure, that only the dots (or any other visual cue, if any at all) are visible.

So:

• when pasting, the password is hidden completely during paste
• when entering by keys, the last character is shown for each keystroke

As others pointed out, AFTER pasting or keying in, the entirety of the password MIGHT get inspected either by F12 or the "eye" icon.

Answer 6

In addition to the other answers: any password manager worth using uses a Master Password that needs to be entered before any passwords can be copied over. If you know that master password, the password manager allows you to see everything, even if you have to paste it in Notepad first. If you don't know that password, the password manager won't do anything with your passwords: it won't decrypt them, it won't autopopulate them, it won't allow you to paste them, it won't allow you to circumvent the protection of that master password in any way.

So if you don't know that master password, there is no way to get the passwords out of the vault (unless the password manager has a vulnerability). If you know the master password, you already have full access to the passwords in the password manager and there is no reason at all to try and circumvent security measures that aren't there.