5

A site (I won't name it) is using an input of type text for its password field in an HTML form. The onfocus method then changes those characters to dots.

Is there a security breach here ?

Or is it more secure than using an input of type password ?

Or is it just a lost opportunity to leverage existing code ?

13
  • 1
    If what u wrote is true, then user clicking outside password field would reveal the password. Jul 28 '15 at 14:59
  • 1
    @QuestionOverflow The password doesn't show when exiting the field. There must be additional JavaScript to keep it in dot form. There was a lot of work that went into avoiding the "password" type apparently. Jul 28 '15 at 15:08
  • 2
    The only security benefit of using type password over type text is to prevent shoulder surfing as pointed out by S.L. Barth. Some mobile websites use text field for password to improve UX since risk of shoulder surfing is lower on a smaller display. Jul 28 '15 at 15:16
  • 1
    I am not sure what year type="password" was drafted but was this website built before that? My only assumption for this design "choice" is that many users were complaining that they could not see their password as they typed and kept locking their accounts, cue upper management, and the poor web developer was coerced into throwing security practices out the window.
    – MonkeyZeus
    Jul 28 '15 at 16:37
  • 3
    @MonkeyZeus I did a little searching. type="password" has been around at least since HTML version 2, around 1995. I'm guessing this website is younger than that.
    – S.L. Barth
    Jul 28 '15 at 17:46
10

This is a vulnerability. If users have JavaScript disabled, their passwords will not be changed to dots, and thus they are vulnerable to shoulder surfing.

As user @Question Overflow points out in their comment to your question, clicking outside the field would also display the password. Which means a co-worker could see the user's password by taking their mouse for a moment - even accidentally.

3
  • 3
    I just tested disabling JavaScript. Password is indeed clearly visible. Jul 28 '15 at 14:50
  • I don't see how is this a vulnerability (while JavaScript is on, that is). They're just using a custom input, and it still hides the password (even when the element loses focus, as the OP cleared up). It's redundant to make such a field, yes, but there's no vulnerability there.
    – rev
    Jul 28 '15 at 22:31
  • In order to reveal password, there would have to be onblur event attached to undo effects of onfocus one. This doesn't happen by magic;)
    – el.pescado
    Jul 29 '15 at 18:45
3

The site may be following the guidance in the article "Stop Password Masking", posted by Jakob Nielsen on June 23, 2009.

Summary: Usability suffers when users type in passwords and the only feedback they get is a row of bullets. Typically, masking passwords doesn't even increase security, but it does cost you business due to login failures.

Password masking addresses the shoulder surfing attack at a substantial cost in usability, especially among non-technical users who do not use a password manager. The site may have weighed the risk of shoulder surfing compared to other attacks on users' credentials and deemed it not worth the loss of usability. I've seen some other sites that use a JavaScript control to toggle the password field's type attribute between "password" and "text", letting the user make his own tradeoff between usability and security against shoulder surfing.

The site in question is described as not quite following this advice. Perhaps the engineers were following this advice but then management requested that it be changed. Or perhaps they were trying to emulate the behavior of mobile devices that briefly show the last entered character in password fields.

2
  • 4
    Maybe, but then they are following Nielsen's advice wrongly as they are still masking the password... just in an unorthodox and vulnerable way.
    – S.L. Barth
    Jul 28 '15 at 17:39
  • While I don't believe this is what they are trying to achieve (because as S.L. Barth pointed out, they're still masking it), it's still interesting. +1. Jul 28 '15 at 20:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.