5

Which browsers allow users to reveal passwords in password fields?

I already know that Windows 8, Windows 8.1, Internet Explorer 10 and Internet Explorer 11 (1). Cursory research did not reveal any other browsers with the "reveal password" feature, but do you know of any others?

Secondly I wonder Are there any UX best practices around passwords that could potentially be revealed?

My answer would be: The best practice is to not allow revealing the password in the input.

The main security risk exists for browsers that save passwords for users to use when auto-completing fields. This means a user might leave their desk and someone who knows their username could cause the password to be populated by auto-completion and then reveal the password using the browser feature.

Improve this question
3
  • 2
    I'd argue that any UX solution to attempt to fix 'lack of security of physical device' are always going to somewhat of a compromise. I could argue that other people sitting down to use someone's browser is not a problem the UI needs to solve. That's a problem the owner of the computer needs to solve.
    – DA01
    Commented Apr 23, 2014 at 19:02
  • That's true, and I can't deny I find the show password feature very useful. However I agree with the OP that it does open up a pretty big security risk because it doesn't just let them into the site (as would autocomplete) but it actually shows the password itself. And (although it shouldn't be) it's probably reused on many other sites.
    – Carmax
    Commented Apr 23, 2014 at 20:18
  • Happening on three versions of OS X in Safari and FF now. Have two iMacs and Airbook.
    – dondi
    Commented Sep 9, 2018 at 13:50

3 Answers 3

Reset to default
5

The best practice is to not allow revealing the password in the input

Don't be so sure. Jakob Nielsen presents the case for not masking passwords at all (emphasis his):

When you make it hard for users to enter passwords you create two problems — one of which actually lowers security:

  • Users make more errors when they can't see what they're typing while filling in a form. They therefore feel less confident. This double degradation of the user experience means that people are more likely to give up and never log in to your site at all, leading to lost business. (Or, in the case of intranets, increased support calls.)
  • The more uncertain users feel about typing passwords, the more likely they are to (a) employ overly simple passwords and/or (b) copy-paste passwords from a file on their computer. Both behaviors lead to a true loss of security.

The article isn't without its detractors (here's a good, deep analysis of the security implications of the proposal).

To answer your particular question, all browsers on OS X theoretically allow users' passwords to be shown in plain text (via the Keychain Access utility), but not within the browser. There is a Firefox Add-on called Show Password, a Chrome Extension called HTML Revealer and Password Revealer, and a Safari Extension called ShowPass all designed to emulate the same function in their own ways.

Improve this answer
8
  • "Copy-paste passwords ... loss of security" - if your input forms require people to use a password manager, that's a good thing, not a bad one. And if the main downside of copying from a plain-text document is shoulder surfing, then making the password field visible is of no benefit at all in that respect.
    – John Dvorak
    Commented Sep 9, 2018 at 13:54
  • @JohnDvorak I don't agree that "the main downside of copying from a plain-text document is shoulder surfing", and that's not how I interpret Nielsen's point either. A plain text password file on a computer can be compromised in many ways that would lead to a "true loss of security" beyond being temporarily visible to shoulder surfers (e.g. inadvertently indexed by system search, found and read by someone with physical access to the computer, disclosed to service technicians when the computer needs repair, etc., etc.).
    – Kit Grose
    Commented Sep 9, 2018 at 14:01
  • If someone has physical access to your computer, they can just install a keylogger and be merry. A screengrabber for those pesky passwords filled in by the browser. A hidden browser extension (or better yet, a custom install) for those even peskier passwords that never show up on screen. In short, If an adversary has direct access to your machine, you've already lost.
    – John Dvorak
    Commented Sep 9, 2018 at 14:06
  • @JohnDvorak Well assuming the OS allows arbitrary executable installation without privilege escalation or a password prompt, sure, but even then your examples are all about getting future access to a machine. Getting a complete, accurate password file doesn't impose any delay or data collection after the fact (including phoning home). It compromises everything, not just the things the user uses after the date the system is compromised (although I'll grant you it's kind of an academic distinction in practice).
    – Kit Grose
    Commented Sep 9, 2018 at 14:10
  • Are you advocating against the use of password managers as well? I can't agree with you doing that.
    – John Dvorak
    Commented Sep 9, 2018 at 14:20
3

If you ask this question on security.stackexchange, the answer will be definite - don't reveal password, ever. It's akin to the poor practice of clicking forgotten password and being emailed your plain-text password, rather than a set of instructions on resetting it. While a user may get frustrated with this UX (Why can't I just see my password right now? Why do I have to reset my password?), security best practices are more important.

Incidentally, any browser allows you to reveal your password due to the mutable nature of DOM (document object model, a in-browser representation of page html). I've used this many-a-time whenever Chrome has better memory than I (normally my "user story" is that I have to log in from another device, and don't remember the password). To test this, go to any login page that your browser stores credentials for, like office365 below:

before tampering

You may have to type in your username before the password asterisks appear, now inspect the password field (in most browsers it's done via right click -> inspect element). If you delete the type="password" attribute, the password field will default to a vanilla text input and you will see the field's value in cleartext. I'm not adding that screenshot though :)

Improve this answer
4
  • I offer a "show password" link below the password field, and make this change to DOM with javascript when the user clicks. Passwords masked by default, revealed on demand seems like splitting the difference between security concerns and UX concerns. I wouldn't do this for a banking website.
    – Chris
    Commented Mar 9, 2015 at 14:36
  • 1
    clicking forgotten password and having a site email your plain text password back to you is NOTHING like making the password visible to the user. The former means your password is vulnerable to your own system being hacked, or the system of the site who store it in plain text. Revealing your password after or during typing only imposes the shoulder surfing risk. So if you are the only person who can see your screen, the extra risk amounts to zero.
    – Greg Woods
    Commented Sep 21, 2018 at 10:09
  • 1
    I disagree that "security best practices" are always more important. The relative importance of security vs. UX depends on the specific propositions being considered. (Also, if you want to tell us what the security.stackexchange people will say, you should probably link to an actual question there instead of just speaking for that whole community.)
    – Brilliand
    Commented Feb 9, 2019 at 1:00
  • 2
    it's not akin to plain-text passwords being emailed at all.
    – worc
    Commented Mar 21, 2019 at 23:14
1

Chrome reveals passwords, although not directly, but through Settings › Passwords and Forms › Manage saved passwords. If I remember well, Firefox has the same feature as well. So in all cases, the user who leaves his desk to somebody exposes himself to a risk of password theft. Since the browser doesn't ask for a master password, it means that it keeps them somewhere, plain text, thus the risk.

UX best practices are mostly related to hiding password from somebody nearby who can see your screen (which can also be a surveillance camera in a public place). This translates to stars in Windows XP and earlier and circles in Windows Vista and later, or to the characters being not displayed at all in Linux console (which also means that one can't know the length neither).

As for the revealing, the only UX concern related to security that I can see is to avoid the person to reveal the password by mistake, or to keep it revealed. That's why in Windows 8, the eye icon doesn't toggle between plain password and circles, but reveals the password only at mouse down event, and hides it again when the user releases the mouse button.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.