1

I've noticed that most apps don't show predictive text suggestions on keypads on login screens. Why is that? Is there some security issue around entering password?

  • 1
    password is a specific type of input that tells devices / browsers to "handle with care". i don't exactly understand what you're asking here. is there a reason why a device should auto-complete sensitive information such as a password? that would be a terrible user experience. – DaveAlger May 11 '15 at 17:54
  • Are you referring to username fields, or password fields? If the latter, @DaveAlger is quite right: massive, ridiculous, glaring security hole. If the former, that's a considerably more interesting question. – Nathan Tuggy May 11 '15 at 20:03
  • Twitter autosuggests available usernames at signup to avoid " this username has already been taken" messages! – Okavango May 11 '15 at 20:56
3

If you are unable to verify that the person accessing the login screen is a trusted user, then displaying predictive text on a username field leads to a very high risk of security breaches because only the password field needs to be determined by the hacker.

If you are able to verify that the person accessing the login screen is a trusted user, then displaying predictive text on a user name field provides some degree of convenience especially if there are multiple people that are likely to access the screen, or if a single person has multiple usernames/accounts that will make input simpler.

I don't think there should ever be any predictive text on password fields, but perhaps asking this question on security stackexchange might help you to answer some of the technical and practical aspects of this question.

| improve this answer | |
0

Predictive searching would certainly be a security problem. Anyone borrowing your computer could quickly find most of your passwords.

However, 'remember password' is a nice feature from a user perspective that browsers like Chrome offer.

The problem is that lots of sites block this by setting the autocomplete attribute on the password field to false.

They do this in the name of 'security' but it's an incredibly annoying feature for the user.

And, ultimately, it can make the site less secure as the user is tired of having to manually enter a password every time and may simply choose a shorter, easier-to-remember password in response.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.