2

I'm working on a web application with a profile page, which is browsed by admin. According to scenario admin may see and change all the information on user's page including the password. User himself may change his password as well.

Problem

So the question is how it will be better to display the password on user's profile page for admin and provide the opportunity to change it.

What is the general approach here? Is it normal to show password as is, not hidden? enter image description here

Or it is better to hide it initially and show after some interactions?

enter image description here

2
  • And what is the best way to provide opportunity to change the password here?
    – Dmitry N
    Jun 17, 2015 at 16:06
  • 1
    If you can show the password to the user, you've just announced to hackers out there that you store user password as plain text. This is a huge security breach. Passwords should be hashed.
    – nightning
    Jun 17, 2015 at 17:14

1 Answer 1

9

This is a security antipattern

It's not a good idea to let admins see a user's actual password ever.

  • Users often use the same password for multiple sites (against better advice), so it's a moral hazard to allow admins to see user passwords.

  • You don't need to see a user's password to change it.

  • Showing a user's password on screen, especially in a web app, is likely a security vulnerability and may render the system vulnerable to script injection, screen reader, or man in the middle attacks.

  • It's not great practice to store a user's password at all. Better practice is to store the hash of a password.

The modern approach is:

  • Store a hash, and not the password at all. This is important, because it's safer and avoids the moral hazard.

  • Never allow admins to see the password. Admins can set a temporary password, but users are forced to set their own password once they enter the system with the temporary one.

  • Passwords may or may not be visible or toggle-visible for users.

2
  • 2
    I can't thank you enough. Everyone should know this
    – megapctr
    Jun 17, 2015 at 19:50
  • 'not a good practice to store a user's password at all' is horribly understated!
    – Aides
    Feb 13, 2017 at 11:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.