I've noticed that on a lot of login forms in websites and applications that there is a "show password" check box. Why? I myself have seen some hacks that an attacker could hack the input password box. Doesn't enabling the "show password" box constitute as a security risk?
1 Answer
The 'show password' option is a feature designed for better user experience. This started getting popular with the recent rise in numbers of mobile devices. The small on screen keyboards are notoriously difficult to type with, and when you are unable to see your input it can make it difficult to be sure the password was typed correctly.
I am not sure of any attacks that target readable password fields. In my opinion, if you have malware on your computer that can see your screen, then its quite probable they are capturing your keystrokes as well.
Is it a risk? Yes. This should never be the default behavior, but if a user feels they are comfortable displaying their password (secure in their physical envirioment), then I see no problem with this practice.
This is just my opinion, not a rule.
answered Dec 23, 2013 at 15:09
-
Follow up question: Why not post that answer in the dupe-source question? It's clearly referenced in Terry's comment. The question will get bumped up and your answer will get your sweet upvotes.– AdiDec 23, 2013 at 15:41
-
I should have checked that before replying, thanks. It looks like Terry's answer is more than complete anyways. Thanks for those sweet upvotes though. Dec 23, 2013 at 17:04
I myself have seen some hacks that an attacker could hack the input password box.Could you expand on this?hackedit). he changed thetype="password"totype="text". Nothing special