Is it safe to use type="text" for password field?

Question

I've researched it and cannot find a standard, dependable way to make a browser prevent autofill and not remember the password in a standard login form.

This is important to me as I'm working on a mobile web app, so if the user clicks logout and someone else gets hold of their phone, the browser shouldn't help them out by just handing them the password!

The only solution I can come up with is to make the password field type="text".

Sure, this would mean people can 'shoulder surf' and see what the user is typing in, but that same person could almost as easily just watch the user's fingers to see what password they're typing in...

I don't think spyware is a real issue here either, as I don't think a type="password" character mask is going to stop a malicious keylogger, etc. from doing its stuff.

So, I'm wondering if there are any other security concerns that I may have missed for using type="text" for a password field?

Maybe if I combined this idea with a dynamic/random 'name' attribute for the input, could I be onto a winner?

NB - The solution needs to be compliant with XHTML Mobile Profile.

Also, please refrain from advising me on what is semantically correct here. My priority is security, not semantics. :)

Answer 1

Bad idea - The browser will remember text fields, it just wont enter them automatically as it does with passwords. Instead it will suggest the password as an autocomplete for all to see. I also think reading a password over someones shoulder is much easier than reading their keystrokes.

The reason some browsers dont respect the autocomplete option for passwords is probably because passwords are handled by a separate (in theory more secure) method for handling/storing password data - obviously by using a text field you are bypassing this system with whatever risks that entails.

I dont think there is a definitive solution that doesnt involve js, since at the end of the day you have no real control over what their browser remembers. You can only provide hints and suggestions. Which will be handled in different ways by different browsers. Your best bet is to start by adding :

autocomplete="off"

to your form and input. Works in most browsers - but not all.

The above would go in your form tag and your password input tag, something like:

<form id="form1_randomstring" name="form1" method="post" action="process.php" autocomplete="off">
<input name="password_randomstring" type="password" value="">

As you said in your question, randomizing the form and input names will also trick some browsers into thinking it is dealing with a different form

Also, browser will be extra conservative about what they remember if you use ssl. So this may help.

Finally, as another layer of protection you could have a little onload jquery to clear the form field manually on docready:

$("input[type='password']").val('');

Obviously no help if not running js.

The Definitive solution (maybe?) You could go a step further and inject the form field using an ajax call (plus generating the random form names + autocomplete and serving the page through ssl). Meaning js would be a requirement for logon but you could then make sure the field was clear and generate the form after page load. I would challenge any browser to complete it then.

If you went for that option both the outer page and the ajax loaded page would have to run through ssl - If you didnt want this an alternative might be to load the ssl form through an iframe (again trade-offs -user base would need to be considered.)

Depending on your requirements and userbase, this could present the most guaranteed option.

NOTE

Autocomplete="off" may not pass strict XHTML validation. An option then may be to add the autocomplete attribute after page load with jquery (again, obviously this wont work without js enabled):

$('#form1').attr('autocomplete', 'off');

As an added point, The simplest way to prevent a key logger would be to provide a select option drop down box and ask them to enter a letter/number from their password. Practically speaking you would have to limit passwords to alphanumeric and ask the user to enter at least three letters/numbers from their password in a series of drop downs.

Summary

No perfect solution but lots of options, you'll have to consider what is right for you. I would maybe go for the ajax call as the main method. You could initially load a link to the form and dynamically replace it with the ajax content so that there is still an option for non js users (less users compromised by autocomplete)