3

Imagine you are in a HTML page which offers you the password change service. Some websites bring the previous password in a password field, which you can't read. Is it possible to retrieve the password in field? (e.g: source code, sniffing the HTTP session?)

How does HTML handle the "security" of this field?

  • 9
    Are you sure that it is the webserver putting that text in the field, or is it your local password manager? – schroeder Sep 5 '15 at 21:13
  • Check the words "imagine" and "some websites". The question is generic @schroeder – user69377 Sep 5 '15 at 22:02
  • 1
    What's the point of providing a change password page with a the previous password field already filled? If you are already logged in, and they don't want more proof that you are Kaguei Nakueka and not a guy who found your computer unlocked, they will simply omit it. – Ángel Sep 5 '15 at 22:34
  • 4
    The reason I ask is because the question lacks some background, context, and the result of some research. Have you tried to look at the page source to see what's available, as you suggest? Can one sniff the HTTP session when authenticated sessions should be served over HTTPS? The only time that I have seen this behaviour is when I have just entered my password, which means that all security should be maintained from the previous screen. You say that this is generic, but details really matter when you ask about "some websites". – schroeder Sep 6 '15 at 0:54
  • @KagueiNakueka Schroeder is not wrong though, there are at least 2 majorly common ways this could happen, either by the server outputting the old password into the change password field (should never happen, but does), or the browser populating this (also shouldn't really happen for change password form, but only for login forms). He was merely trying to understand what situation you are imagining - since imagination runs differently, and you explicitly specific change password form (vs. simple login form). – AviD Sep 6 '15 at 13:29
15

If they have the real old password in the field you can retrieve it by looking at the source of the HTML page. But usually there is only a placeholder like "this was the old password" which is used to detect if the user changes the password or if something else inside the formular gets changed. With proper security the site cannot even put the old password into the form since the clear text password itself should not be known to the site because the password was stored in an irreversible way (see how your passwords are stored on the internet..).

6

Some websites bring the previous password in a password field, which you can't read.

When you see points or asterisks in the password field, it is because your browser remembers your username and password and when the page is loaded populates the fields.

Sometimes, mostly in password change forms, your 'old password' appears as a set of asterisks. The server should never send the password or its length to the client, instead a constant or random-length string of asterisks must be used.

There are some rules to follow with passwords. Passwords should never be sent to the client. The computer might have been stolen or maybe someone else is using it, and as users tend to use many times the same password this may compromise other accounts in different sites.

Furthermore, passwords should never be stored in the server. Instead the salt-hash method must be used. This makes passwords harder to brute-force in case our database is stolen. And also prevents careless programmers from sending passwords to the client.

This are best practices that most sites follow, but designers can do things differently, and often dangerously. I encourage you to read website sources and try to understand how things are done.

  • Your second rule implies your first rule. If you don't store them you can't send them. – user207421 Sep 6 '15 at 1:00
3

If you mean the password that's saved in the browser and shown as asterisks, you can simply reveal it by editing the page source code and change the input type from password to text. You can view and edit the page source code in Chrome and Firefox by right clicking on the input field and choose inspect element.

2

In highly doubt that the password information is really transmitted by the server. Well, assuming that there is in fact such kind of information present:

  • Retrieving this kind of information by sniffing the HTTP transferred data when received or sent. The significant information should be a part of the received data and the sent data.
  • Retrieving the password information from the DOM.

I can mention two excellent addons for Firefox to potentially achieve this goal. Tamper Data: to catch the HTTP data Firebug: to look up the DOM and HTML

You may face the problem that the password will not be plain text. This may indicate that the data must be decrypted on the client side by some script. Then, there would be only a shot sequence where the information is genuine. Every further security should now depend the verification process on the server side. Even thou this seems to be the best method to guarantee security, a large part of the process depends on the front end so there it is vulnerable.

Overall it really depends on the real security sequence used for this process.

The best way to grab genuine data is while the client sends the data, assuming there will be no encryption process before the data is sent.

I don't believe that HTML itself provides advanced features to handle such kind of data, just hiding the content.

But I highly assume that the data is processed by a script on the client side to keep the information secret. This would be the best way to compensate the missing security. Also, the data may be a not the password, but more likely a hash or token.

Here is a simple example for your case:

<!DOCTYPE html>
<html>
<body>

Type the secret code:
<input id="Passwd" name="Passwd" type="password" placeholder="Passwort" class="" value="catchme">
<p>Click the button to return the value of secret code.</p>

<button type="button" onclick="myFunction()">Try it</button>

<script>
function myFunction() {
    alert(document.getElementById("Passwd").value);
}
</script>

</body>
</html>

Online: https://jsfiddle.net/naheb7f8/ a XSS warning popup may appear.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy