HTML password fields

Question

Imagine you are in a HTML page which offers you the password change service. Some websites bring the previous password in a password field, which you can't read. Is it possible to retrieve the password in field? (e.g: source code, sniffing the HTTP session?)

How does HTML handle the "security" of this field?

Answer 1

If they have the real old password in the field you can retrieve it by looking at the source of the HTML page. But usually there is only a placeholder like "this was the old password" which is used to detect if the user changes the password or if something else inside the formular gets changed. With proper security the site cannot even put the old password into the form since the clear text password itself should not be known to the site because the password was stored in an irreversible way (see how your passwords are stored on the internet..).

Answer 2

Some websites bring the previous password in a password field, which you can't read.

When you see points or asterisks in the password field, it is because your browser remembers your username and password and when the page is loaded populates the fields.

Sometimes, mostly in password change forms, your 'old password' appears as a set of asterisks. The server should never send the password or its length to the client, instead a constant or random-length string of asterisks must be used.

There are some rules to follow with passwords. Passwords should never be sent to the client. The computer might have been stolen or maybe someone else is using it, and as users tend to use many times the same password this may compromise other accounts in different sites.

Furthermore, passwords should never be stored in the server. Instead the salt-hash method must be used. This makes passwords harder to brute-force in case our database is stolen. And also prevents careless programmers from sending passwords to the client.

This are best practices that most sites follow, but designers can do things differently, and often dangerously. I encourage you to read website sources and try to understand how things are done.

Answer 3

If you mean the password that's saved in the browser and shown as asterisks, you can simply reveal it by editing the page source code and change the input type from password to text. You can view and edit the page source code in Chrome and Firefox by right clicking on the input field and choose inspect element.

Answer 4

In highly doubt that the password information is really transmitted by the server. Well, assuming that there is in fact such kind of information present:

• Retrieving this kind of information by sniffing the HTTP transferred data when received or sent. The significant information should be a part of the received data and the sent data.
• Retrieving the password information from the DOM.

I can mention two excellent addons for Firefox to potentially achieve this goal. Tamper Data: to catch the HTTP data Firebug: to look up the DOM and HTML

You may face the problem that the password will not be plain text. This may indicate that the data must be decrypted on the client side by some script. Then, there would be only a shot sequence where the information is genuine. Every further security should now depend the verification process on the server side. Even thou this seems to be the best method to guarantee security, a large part of the process depends on the front end so there it is vulnerable.

Overall it really depends on the real security sequence used for this process.

The best way to grab genuine data is while the client sends the data, assuming there will be no encryption process before the data is sent.

I don't believe that HTML itself provides advanced features to handle such kind of data, just hiding the content.

But I highly assume that the data is processed by a script on the client side to keep the information secret. This would be the best way to compensate the missing security. Also, the data may be a not the password, but more likely a hash or token.

Here is a simple example for your case:

<!DOCTYPE html>
<html>
<body>

Type the secret code:
<input id="Passwd" name="Passwd" type="password" placeholder="Passwort" class="" value="catchme">
<p>Click the button to return the value of secret code.</p>

<button type="button" onclick="myFunction()">Try it</button>

<script>
function myFunction() {
    alert(document.getElementById("Passwd").value);
}
</script>

</body>
</html>

Online: https://jsfiddle.net/naheb7f8/ a XSS warning popup may appear.