Today I went to log into my American Express Serve account at https://secure.serve.com/ and accidentally discovered what appears to be a huge hole in their login process.
Here are the steps involved:
- Enter a valid email Serve email address into the Email box.
- Type at least one character in the Password box.
- Tab out of the Password box.
- "Please enter a valid password." is now shown in red below the password box.
- Go back to the Password box and start typing characters.
- With each character typed, the password is checked. Once the password is valid, the red text goes away, indicating a valid password.
Now, once the Log In button is hit, the user is asked security questions. This seems to mitigate the problem, but the password is already known at this point!
Comments in this question are correct: The password isn't being checked. What is being checked is whether the characters entered match the password requirements. This does seem to be a reasonable behavior.