5

A site (I won't name it) is using an input of type text for its password field in an HTML form. The onfocus method then changes those characters to dots.

Is there a security breach here ?

Or is it more secure than using an input of type password ?

Or is it just a lost opportunity to leverage existing code ?

Improve this question
13
  • 1
    If what u wrote is true, then user clicking outside password field would reveal the password.
    – Question Overflow
    Jul 28, 2015 at 14:59
  • 1
    @QuestionOverflow The password doesn't show when exiting the field. There must be additional JavaScript to keep it in dot form. There was a lot of work that went into avoiding the "password" type apparently.
    – Philippe Carriere
    Jul 28, 2015 at 15:08
  • 2
    The only security benefit of using type password over type text is to prevent shoulder surfing as pointed out by S.L. Barth. Some mobile websites use text field for password to improve UX since risk of shoulder surfing is lower on a smaller display.
    – Question Overflow
    Jul 28, 2015 at 15:16
  • 1
    I am not sure what year type="password" was drafted but was this website built before that? My only assumption for this design "choice" is that many users were complaining that they could not see their password as they typed and kept locking their accounts, cue upper management, and the poor web developer was coerced into throwing security practices out the window.
    – MonkeyZeus
    Jul 28, 2015 at 16:37
  • 3
    @MonkeyZeus I did a little searching. type="password" has been around at least since HTML version 2, around 1995. I'm guessing this website is younger than that.
    – S.L. Barth is on codidact.com
    Jul 28, 2015 at 17:46

2 Answers 2

Reset to default
10

This is a vulnerability. If users have JavaScript disabled, their passwords will not be changed to dots, and thus they are vulnerable to shoulder surfing.

As user @Question Overflow points out in their comment to your question, clicking outside the field would also display the password. Which means a co-worker could see the user's password by taking their mouse for a moment - even accidentally.

Improve this answer
3
  • 3
    I just tested disabling JavaScript. Password is indeed clearly visible.
    – Philippe Carriere
    Jul 28, 2015 at 14:50
  • I don't see how is this a vulnerability (while JavaScript is on, that is). They're just using a custom input, and it still hides the password (even when the element loses focus, as the OP cleared up). It's redundant to make such a field, yes, but there's no vulnerability there.
    – rev
    Jul 28, 2015 at 22:31
  • In order to reveal password, there would have to be onblur event attached to undo effects of onfocus one. This doesn't happen by magic;)
    – el.pescado - нет войне
    Jul 29, 2015 at 18:45
3

The site may be following the guidance in the article "Stop Password Masking", posted by Jakob Nielsen on June 23, 2009.

Summary: Usability suffers when users type in passwords and the only feedback they get is a row of bullets. Typically, masking passwords doesn't even increase security, but it does cost you business due to login failures.

Password masking addresses the shoulder surfing attack at a substantial cost in usability, especially among non-technical users who do not use a password manager. The site may have weighed the risk of shoulder surfing compared to other attacks on users' credentials and deemed it not worth the loss of usability. I've seen some other sites that use a JavaScript control to toggle the password field's type attribute between "password" and "text", letting the user make his own tradeoff between usability and security against shoulder surfing.

The site in question is described as not quite following this advice. Perhaps the engineers were following this advice but then management requested that it be changed. Or perhaps they were trying to emulate the behavior of mobile devices that briefly show the last entered character in password fields.

Improve this answer
2
  • 4
    Maybe, but then they are following Nielsen's advice wrongly as they are still masking the password... just in an unorthodox and vulnerable way.
    – S.L. Barth is on codidact.com
    Jul 28, 2015 at 17:39
  • While I don't believe this is what they are trying to achieve (because as S.L. Barth pointed out, they're still masking it), it's still interesting. +1.
    – Philippe Carriere
    Jul 28, 2015 at 20:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .