Should a (permanent) password field show the correct amount of bullets of the entered password?

Question

I'm working on an desktop program and noticed the following interface:

Don't want to go into the details of the form, but basically, the user can enter an alternative username/password to login into a server.

As a safety precaution, a developer hashed the password and after saving, the hashed password is returned into the password field. So if i enter username: Admin and password: 12345 (So 5 bullets are visible), and i press save, the 5 bullets will be replaced with 20 bullets and login will be successful.

As a reason, the developer said: "You don't want to give a hint on the length of the password"

In my opinion, this is a bit confusing, since the entered password is replaced with an "unknown" new string, but password is still correct.

In Avast Anti-virus, i noticed that this doesn't happen in the proxy settings. The entered password isn't changed.

I couldn't find many other applications that use a permanent username/password field. More often than not, a username/password field is a temporary thing and disappears after a correct login.

Answer 1

I realise you asked this question a few weeks ago, but products do get iterated, and perhaps this product is not yet released.

With that in mind, in your shoes I would have asked the developer these questions:

• Is the user entering this password in a setting where others are watching? If not, why obscure it? Alternatively, allow the user to decide whether to obscure the password.
• The discrepancy between the number of bullets and the number of characters in the password will confuse some users some of the time. Is the security risk of displaying the password so great that this confusion can be justified?
• Does the UI always display the Password (Wachtwoord) box—even when the user's task is not about entering the password? If so, why not hide the password box, because it displays nothing of value to anyone.

I hope these thoughts are helpful. :)

Answer 2

I have seen this behaviour before (possibly windows login?) and I would side with the Developer.

It may be a little confusing at first, but once someone hits login second time around they'll realise how it works. I've seen security software (disk encryption) take this further in that when you press a key typing a non-saved password multiple spaces or * appear rather than a 1-1 mapping to characters.

What's more, is it helps to encourage the user you've taken security seriously and your not presenting their real password as stars, and does seriously increase your security protection.